Hackers try to exploit new ‘Text4Shell’ vulnerability

Share post:

Wordfence, a WordPress security company, has discovered exploitation attempts by hackers targeting the new Text4Shell vulnerability. Tracked as CVE-2022-42889, the vulnerability was discovered on October 18, 2022, in the Apache Commons text.

The vulnerability has a severity of 9.8 out of a possible 10.0 and affects versions 1.5 to 1.9 of the library. Once the vulnerability is successfully exploited, an attacker can establish a reverse shell connection to the vulnerable application by simply using a specially crafted payload, which ultimately opens the door to subsequent attacks.

“The attacker can send a crafted payload remotely using ‘script’,’ ‘dns,’ and ‘url’ lookups to achieve arbitrary remote code execution,” the Zscaler ThreatLabZ team explained.

According to security experts, Text4Shell is similar to the popular Log4Shell vulnerability. Just like Log4Shell, Text4Shell is rooted in the way string substitutions are performed during DNS, script, and URL lookups which could lead to the execution of arbitrary code on susceptible systems when passing untrusted input.

However, Wordfence explained that the chances of successful exploitation are considerably limited compared to Log4j, as most of the payloads observed so far are designed to look for vulnerable installations.

“Fortunately, not all users of this library would be affected by this vulnerability – unlike Log4j in the Log4Shell vulnerability, which, which was vulnerable even in its most basic use-cases. Apache Commons Text must be used in a certain way to expose the attack surface and make the vulnerability,” said Checkmarx researcher Yaniv Nizry.

The sources for this piece include an article in TheHackerNews.


Related articles

Cyber Security Today, June 21, 2024 – US to ban Kaspersky for businesses, consumers

U.S. to ban the sale of Kaspersky products to consumers and businesses. Welcome to Cyber Security Today. It's Friday...

Biden administration to ban US sales of Kaspersky software over ties to Russia

The Biden administration is set to announce a ban on the sale of Kaspersky Lab's antivirus software in...

Security bug may allow anyone to spoof Microsoft employee emails

A security researcher claims to have discovered a bug that enables anyone to impersonate Microsoft corporate email accounts,...

Cyber Security Today, June 19, 2024 – How an attacker hid on an IT network for three years

How an attacker hid on an IT network for three years Welcome to Cyber Security Today. It's Wednesday June...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways