Apache Commons Configuration up to 2.7.x Variable Interpolation privilege escalation

Summaryinfo

A vulnerability identified as critical has been detected in Apache Commons Configuration up to 2.7.x. This vulnerability affects unknown code of the component Variable Interpolation Handler. The manipulation leads to an unknown weakness. This vulnerability is documented as CVE-2022-33980. The attack can be initiated remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache Commons Configuration up to 2.7.x and classified as critical. This issue affects some unknown functionality of the component Variable Interpolation Handler. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.

The weakness was released 07/06/2022. The advisory is shared at lists.apache.org. The identification of this vulnerability is CVE-2022-33980 since 06/18/2022. Neither technical details nor an exploit are publicly available.

Upgrading to version 2.8.0 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Apache

Name

• Commons Configuration

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion