Picus Security Analyzes Critical Apache Commons Text Vulnerability

Cybersecurity firm Picus Security has detailed an analysis of a critical vulnerability discovered in the Apache Commons Text library, identified as CVE-2022-42889. The vulnerability carries a high CVSS score of 9.8 and allows unauthenticated attackers to execute arbitrary commands on systems utilizing the library.

In insecure implementations, the vulnerability arises when the library processes untrusted inputs, such as DNS requests or URLs. According to Picus Security, versions 1.5 through 1.9 of Apache Commons Text are affected, and its exploitation is also dependent on the Java Development Kit (JDK) version in use. The vulnerability's impact has been compared to Log4Shell, though its exploitability is assessed as similar to Spring4Shell.

Picus Security recommends updating the Apache Commons Text library to version 1.10.0 immediately. As this is a library-level vulnerability, it is crucial for organizations to update all dependent products and services as vendors release patches. In the interim, proper sanitization of external inputs can prevent potentially risky situations.

The company also offers the capability through its platform to simulate CVE-2022-42889 exploits as part of security control testing, helping organizations assess the effectiveness of their defenses and identify potential cybersecurity gaps.