Connect with us
ANE Scholarship
Categories:
X

Technology

Apache Commons Text RCE: Similar to Log4Shell, but with “far reduced” exposure risk

Published

on

Apache Commons Text RCE: Similar to Log4Shell, but with "far reduced" exposure risk
Share this post:

A critical flaw patched in the Apache Commons Text library has sparked comparisons with the ‘Log4Shell’ bug that surfaced in the near-ubiquitous open source component Log4j last year.

However, the researcher who found and reported the Commons Text flaw in March has downplayed its comparative impact, while acknowledging a resemblance to the ‘Log4Shell’ vulnerability that is widely recognized as one of the most severe flaws of all time.

Lookup link

“The vulnerability is indeed very similar,” GitHub Security Lab principal researcher Alvaro Muñoz told Daily Swig.

“The Apache Commons Text code appears to be based on the Log4j code, as both of them enable interpolation of multiple Lookup sources. Log4j enabled JNDI lookups [while] Apache Commons Text and Apache Commons Configuration allows script lookups – both could lead to RCE. The impact is, therefore, very high.

“However, it is worth keeping in mind that an issue’s severity is calculated based on both the impact and the likelihood, and for the Apache Commons Text, the likelihood of untrusted data flowing to ACT’s sink is much lower.”

Apache Commons Text performs text operations such as escaping, calculating string differences, and substituting placeholders in text with values looked up through interpolators. Fellow open source library Log4j is a Java-based logging utility.

Tracked as CVE-2022-42889, the Commons Text bug emerged on October 13 with an Apache Software Foundation (ASF) security advisory.

The vulnerability centers on an insecure implementation of the library’s variable interpolation functionality, namely that certain default lookup strings could potentially accept untrusted input from remote attackers, such as DNS requests, URLs, or inline scripts.

‘Clearly documented’

A technical analysis published yesterday by Rapid7 also attempted to tamp down hype over the bug, whose CVSS score of 9.8 is nevertheless close to Log4Shell’s perfect 10 on the severity front.

The vulnerable “StringSubstitutor interpolator is considerably less widely used than the vulnerable string substitution in Log4j and the nature of such an interpolator means that getting crafted input to the vulnerable object is less likely than merely interacting with such a crafted string as in Log4Shell,” said Rapid7.

Arnout Engelen, security response program manager at the ASF, echoed these sentiments, telling Daily Swig: “In Log4Shell, string interpolation was possible from the log message body, which commonly contains untrusted input. In the Apache Common Text issue, the relevant method is explicitly intended and clearly documented to perform string interpolation, so it is much less likely that applications would inadvertently pass in untrusted input without proper validation.”

Remediation

The flaw affects Apache Commons Text versions 1.5 through 1.9, and all JDK versions, and has been patched in version 1.10.

Engelen said: “When using the string substitution feature, some of the available interpolators can trigger network access or code execution. This is intended, but it also means an application that includes user input in the string passed to the substitution without properly sanitizing it would allow an attacker to trigger those interpolators.

“For that reason the Apache Commons Text team have decided to update the configuration to be more ‘secure by default’, so that the impact of a failure to validate inputs is mitigated and will not give an attacker access to these interpolators.

“However, it is still recommended that users treat untrusted input with care. We’re not currently aware of any applications that pass untrusted input to the substitutor and thus would have been impacted by this problem prior to Apache Commons Text 1.10.0.”

Rapid7 recommends that developers and maintainers watch out for follow-on vendor advisories, install “patches as they become available, and prioritize anywhere the vendor indicates that their implementation may be remotely exploitable”.


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment

Russia ‘having to re-use outdated missiles from the 80s with nuclear warheads removed’
News24 mins ago

Russia ‘having to re-use outdated missiles from the 80s with nuclear warheads removed’

News34 mins ago

Dauda Biu decries killing of 2 officers

News41 mins ago

It’s Wrong Of You To Frolic With Politicians – Atiku’s Aide Tells CJN

Sports54 mins ago

FIFA World Cup 2022: Duke’s first half header helps Australia to victory against Tunisia

News1 hour ago

Ugwuanyi visits community affected by farmers-herders clash in Enugu

News2 hours ago

Action Alliance disowns litigants against Bola Tinubu

2023 Election: I’m out to win 2023 election – Kola Abiola
News2 hours ago

FHC fines PRP presidential candidate for late filing of documents

Portable releases new album, 'Ika of Africa'
Entertainment2 hours ago

Portable releases new album, ‘Ika of Africa’

Rising sensation LB releases new single, 'Matter'
Entertainment3 hours ago

Rising sensation LB releases new single, ‘Matter’

Dozzybeat features Byno for ‘Angelina’
Entertainment3 hours ago

Dozzybeat features Byno for ‘Angelina’

Dr. Dolor's album, "What A Time To Bee Alive," includes Oxlade, BNXN, Seun Kuti, and Blaqbonez
Entertainment3 hours ago

Dr. Dolor’s album, “What A Time To Bee Alive,” includes Oxlade, BNXN, Seun Kuti, and Blaqbonez

The SIXTEENTH Story by Moshood Avidiime - ANE Story
ANE Stories3 hours ago

[STORY] The SIXTEENTH (Final Episode 07)

The SIXTEENTH Story by Moshood Avidiime - ANE Story
ANE Stories4 hours ago

[STORY] The SIXTEENTH (Episode 06)

Osun state Governor, Gboyega Oyetola.
News4 hours ago

Oyetola signs N138bn budget into law in Osun

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories4 hours ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 19)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories4 hours ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 18)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories4 hours ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 17)

News4 hours ago

Dankwambo Dumps Wike’s Camp, Donates 20 Buses To Atiku’s Campaign

News4 hours ago

APC mega rally: Jandor berates Sanwo-Olu for closing down Lagos markets

Apple has revealed the iPhone 14 and 14 Plus
Technology6 hours ago

How to recover ‘deleted text messages’ on iPhone

Sasha Attwood, Georgia Irwin and Paige Milian cheer on England boys in World Cup
Sports7 hours ago

Sasha Attwood, Georgia Irwin and Paige Milian cheer on England boys in World Cup

Gareth Southgate explains why he didn’t bring on Phil Foden during USA World Cup draw
Sports7 hours ago

Gareth Southgate explains why he didn’t bring on Phil Foden during USA World Cup draw

Mason Mount wasn’t subbed off during England’s World Cup draw with USA – Rob Green
Sports7 hours ago

Mason Mount wasn’t subbed off during England’s World Cup draw with USA – Rob Green

Gareth Southgate
Sports7 hours ago

Gareth Southgate responds to fans booing England

Horoscope7 hours ago

Your daily horoscope for Saturday, November 26, 2022

USA bundled England To Secure a Tough Draw
ANE Football Analytical15 hours ago

Maybe Qatar Is Low Budget England FC

USA bundled England To Secure a Tough Draw
Sports15 hours ago

World Cup Result: USA bundled England To Secure a Tough Draw

Twitter
Technology19 hours ago

Elon Musk to provide ‘amnesty’ to some suspended accounts

Twitter fails to remove racist tweets targeted at World Cup stars
Technology19 hours ago

Twitter fails to remove racist tweets targeted at World Cup stars

80% road traffic accidents caused by human error – Shehu Mohammed
News19 hours ago

FRSC is not recruiting, stop patronizing scammers – Spokesman

Buhari
News19 hours ago

Buhari doesn’t ‘use and dump’ – Ibrahim Gambari

News19 hours ago

FRSC decries carrying fuel in gallons on journeys

South East has rejected Tinubu – Bwala
News19 hours ago

South East has rejected Tinubu – Bwala

Guber candidate says It’s time for APC to takeover Benue
News20 hours ago

Guber candidate says It’s time for APC to takeover Benue

News20 hours ago

INEC releases guidelines for political campaigns, party expenses

Sports20 hours ago

FIFA World Cup 2022: Qatar on verge of World Cup elimination after defeat to Senegal

Mercy Eke predicts Peter Obi's victory in 2023 elections
Entertainment21 hours ago

Mercy Eke predicts Peter Obi’s victory in 2023 elections

BBNaija's Pere shares his dream of becoming an evangelist
Entertainment21 hours ago

BBNaija’s Pere shares his dream of becoming an evangelist

Sammie Okposo passes away at 51
Entertainment21 hours ago

Sammie Okposo passes away at 51

Ayra Starr responds to criticism on her skimpy outfit
Entertainment21 hours ago

Ayra Starr responds to criticism on her skimpy outfit

Movie Subtitle6 days ago

DOWNLOAD Complete Black Adam (2022 film) Subtitles File [English SRT] 2022

WC 2022: Ecuador's Enner Valencia scores opening goal against host Qatar
Sports6 days ago

No Beer No Problem! Ecuador Destroys Qatar in World Cup Opening Game [WATCH HIGHLIGHT]

Brazil chooses "unusual" starting lineup for the World Cup opener against Serbia, leaving Fred out
Sports3 days ago

Brazil chooses “unusual” starting lineup for the World Cup opener against Serbia, leaving Fred out

Sports6 days ago

Anthony Martial among three options being considered to replace Karim Benzema in France squad

I’ve made many sacrifices for my music – Dote Urban
Entertainment7 days ago

I’ve made many sacrifices for my music – Dote Urban

Qatar 2022 World Cup Opening Ceremony _ All Naija Entertainment
ANE Football Analytical6 days ago

World Cup 2022: Poor Qatar Has Absolutely Nothing To Press Against Ecuador

News6 days ago

Reno Omokri speaks after “Obi’s Supporters” made him waste $4,000 on Tinubu’s investigation

Bellingham Saka, Grealish, Rashford Helps England Destroy Iran in Qatar
Sports5 days ago

Saka, Grealish, Rashford Helps England Destroy Iran in Qatar’s World Cup [WATCH HIGHLIGHT]

Blood And Water: All episode titles for season 3
Entertainment4 days ago

Blood And Water: All episode titles for season 3

Dj Sumbody shot dead in South Africa
Entertainment5 days ago

Dj Sumbody shot dead in South Africa

Your weekly tarot horoscope for July 24 to July 30 – and Jupiter going retrograde
Horoscope6 days ago

Your weekly tarot horoscope for November 20 to 26

Kizz Daniel Delivers A Spectacular Performance At 2022 FIFA World Cup, Qatar
Celebrity2 days ago

Kizz Daniel Delivers A Spectacular Performance At 2022 FIFA World Cup, Qatar

Entertainment5 days ago

Cristiano Ronaldo gain 500 million Instagram followers

Why World Cup stadium called 'Stadium 974' and why is it made of containers?
Sports4 days ago

Why World Cup stadium called ‘Stadium 974’ and why is it made of containers?

World Cup 2022: Saudi Arabia defeats Argentina as they end their 36-game unbeaten run
Sports4 days ago

World Cup 2022: Saudi Arabia defeats Argentina as they end their 36-game unbeaten run

All Day DevOps: Third of Log4j downloads continue to use insecure versions despite threat of supply chain attacks
Technology5 days ago

All Day DevOps: Third of Log4j downloads continue to use insecure versions despite threat of supply chain attacks

WC 2022: Ecuador's Enner Valencia scores opening goal against host Qatar
Sports6 days ago

WC 2022: Ecuador’s Enner Valencia scores opening goal against host Qatar

Sports7 days ago

John Barnes warns Bukyao Saka may not feature much for England at World Cup in Qatar

Bola Tinubu
News7 days ago

Miyetti Allah justifies his backing of Tinubu

Technology3 days ago

Twitter resumed hiring after Elon Musk declared the end of layoffs

Mayorkun and Oxlade collaborate on the new song "Bad Boy"
Entertainment2 days ago

Mayorkun and Oxlade collaborate on the new song “Bad Boy”

Avatar: The Way Of Water trailer
Entertainment3 days ago

Avatar 2 is ‘very f**king’ expensive – James Cameron

Kevin De Bruyne discusses their falling out after Belgium's victory over Canada
Sports2 days ago

Kevin De Bruyne discusses their falling out after Belgium’s victory over Canada

News4 days ago

Nigeria still maintains COVID-19 travel protocols – FG

Entertainment5 days ago

“Toyin Abraham Is In The Past, Nobody Should Ask Me about Her Again” – Seun Egbegbe

Sports2 days ago

England must ‘focus on football’ instead of ‘gestures’ to protest OneLove armband ban – Gareth Southgate

Lupita Nyong’o
Entertainment6 days ago

Lupita Nyong’o shares training routine for Black Panther

Tompolo donates N150m to help flood victims in Bayelsa, Rivers, Delta
News5 days ago

Tompolo donates N150m to help flood victims in Bayelsa, Rivers, Delta

Thousands of World Cup seats remain unfilled despite Qatar's shady announcement of attendance data
Sports4 days ago

Thousands of World Cup seats remain unfilled despite Qatar’s shady announcement of attendance data

World Cup commentator Sam Matterface says Roy Keane just pretends to be ‘steely’
Sports5 days ago

World Cup commentator Sam Matterface says Roy Keane just pretends to be ‘steely’

World Cup Result: 2-Bangs From Richarlison Saves Brazil From Serbia
Sports2 days ago

World Cup Result: 2-Bangs From Richarlison Saves Brazil From Serbia [WATCH VIDEO HIGHLIGHT]

2022 AMAs: 5 cutest couples that graced the red carpet
Entertainment5 days ago

2022 AMAs: 5 cutest couples that graced the red carpet

Nasa’s Artemis spaceship arrives at the moon
Technology4 days ago

Nasa’s Artemis spaceship arrives at the moon

Nigerians respond to the newly designed naira notes as Emefiele trends on Twitter
News3 days ago

Nigerians respond to the newly designed naira notes as Emefiele trends on Twitter

Gareth Bale believes representing Wales at the World Cup is ‘the biggest honour’
Sports5 days ago

Gareth Bale believes representing Wales at the World Cup is ‘the biggest honour’

YCEE returns with new single, 'Azul '22' feat Costa Titch, Phantom Steeze & Ma Gang Official
Entertainment4 days ago

YCEE returns with new single, ‘Azul ’22’ feat Costa Titch, Phantom Steeze & Ma Gang Official

Bola Tinubu
News7 days ago

I Don’t Read Social Media Anymore, They Abuse The Hell Out Of Me – Tinubu (Video)

David Beckham Is 'Open To Talks' Over Manchester United Takeover
Sports2 days ago

David Beckham Is ‘Open To Talks’ Over Manchester United Takeover

Dietmar Hamann blasts Antonio Rudiger after Germany’s World Cup defeat to Japan
Sports2 days ago

Dietmar Hamann blasts Antonio Rudiger after Germany’s World Cup defeat to Japan

Zlatan teams up with Young Jonn, Willis for the new street anthem "Astalavista"
Entertainment2 days ago

Zlatan teams up with Young Jonn, Willis for the new street anthem “Astalavista”

ANE Billboard Hots