Arbitrary Code Execution Affecting org.apache.commons:commons-configuration2 package, versions [2.4,2.8)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-JAVA-ORGAPACHECOMMONS-2944970
- published 8 Jul 2022
- disclosed 7 Jul 2022
- credit Unknown
How to fix?
org.apache.commons:commons-configuration2 to version 2.8 or higher.
org.apache.commons:commons-configuration2 is a group of tools to assist in the reading of configuration/preferences files in various formats.
Affected versions of this package are vulnerable to Arbitrary Code Execution via the
Lookup functionality due to the ability to use certain insecure lookups that perform interpolation.
These lookups are:
scriptexecute expressions using the JVM script execution engine (
dnsresolve DNS records.
urlload values from URLs, including from remote servers.
CVSS Score Explanation:
This module is designed for secure configuration management. This implies that the files it handles should have limited access, whether local or remote. Remote attacks require basic privileges and server setup for remote commands. This aligns with AC:H and PR:L