Remote Code Execution Vulnerability in Apache Commons Configuration 2.x
Summary
CVE-2022-33980: Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. Affects commons-configuration2 versions < 2.8.0-1~deb11u1. Fixed in 2.8.0-1~deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Commons Configuration is a popular library that provides a flexible and comprehensive way to manage configuration data in Java applications. It supports various configuration sources, including properties files, XML, and databases. The library allows for dynamic evaluation and expansion of properties through variable interpolation, which is a powerful feature but can also introduce security risks if not handled properly. The vulnerability in question affects versions 2.4 to 2.7, where default interpolators can lead to arbitrary code execution or unintended contact with remote servers.
Vulnerability Detail
The vulnerability arises from the way Apache Commons Configuration handles variable interpolation. The library includes default Lookup instances that can execute scripts, resolve DNS records, and load values from URLs. Specifically, the 'script', 'dns', and 'url' lookups can be exploited if untrusted configuration values are used, potentially allowing attackers to execute arbitrary code or communicate with remote servers. This vulnerability is particularly severe, with a CVSS score of 9.8, indicating a high risk of exploitation.
How To Fix
Minimum fixed version
2.8.0-1~deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade commons-configuration2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to manually disable the problematic interpolators in your configuration setup. This can be done by overriding the default configuration settings to exclude the 'script', 'dns', and 'url' lookups from being used in your application.
Conclusion
The Apache Commons Configuration vulnerability CVE-2022-33980 poses a significant risk due to its potential for remote code execution and unintended server contact. Users are strongly advised to upgrade to version 2.8.0 or later to mitigate these risks. For those unable to upgrade immediately, implementing workarounds can provide temporary relief until a proper fix is applied.
See every vulnerability recorded for commons-configuration2 →
FAQ
Versions 2.4 to 2.7 are affected by this vulnerability.
If not fixed, attackers could exploit the vulnerability to execute arbitrary code or access remote servers, leading to potential data breaches or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, you can temporarily disable the problematic interpolators in your configuration settings as a workaround.
The CVSS score of this vulnerability is 9.8, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for commons-configuration2.
