Red Hat JBoss - Insecure Deserialization

Red Hat JBoss Application Server 4.x, 5.x, 6.x contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apach...

CVE-2022-42889-Analysis

CVE-2022-42889 Text4Shell Report A repository that organizes an analysis report for Apache Commons Text CVE-2022-42889 and attack demonstration materials based on a closed test environment. Documents CVE-2022-42889 - Vulnerability Analysis Report Repository Structure CVE-2022-42889-Report/ ├─...

text4shell-poc

CVE-2022-42889 PoC Test Application This is a vulnerable application developed as a Proof of Concept for the vulnerability CVE-2022-42889. Maven Installation In order to run this you will need: JDK 17 or above Maven 1. Clone the git repo git clone https://github.com/securekomodo/text4shell-poc.gi...

riskootext4shell

riskootext4shell text4shell script for Apache Commons Text =1.10 CVE-2022-33980 The Apache Commons Text library is an alternative to the native functionalities of the Java JDK. Versions prior to version 1.10.0 of Apache Commons Similar to CVE-2022-33980 python3 text4shell.py -u...

ysoserial

ysoserial A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. Description Originally released as part of AppSecCali 2015 Talk "Marshalling Pickles: how deserializing objects will ruin your day" with gadget chains for Apache Commons Collections 3.x and...

CVE-2022-42889-text4shell

CVE-2022-42889-text4shell Description This script is a penetration testing tool designed to exploit the CVE-2022-42889 vulnerability, also known as Text4Shell, within Apache Commons Text versions -param $PARAMETER -L $LHOST -P $LPORT Example python3 exploit.py -t 10.10.10.10 -p 8080 -u /search/...

CVE-2022-42889-RCE

CVE-2022-42889-PoC Proof of Concept for CVE-2022-42889 remote code execution exploit Text4Shell Vulnerability. Give a ⭐ for support ❤️ About this vulnerability CVE-2022-42889 is a new critical vulnerability similar to Spring4Shell and Log4Shell. Its a RCE Remote Code Execution vulnerability with...

CVE-2022-42889-PoC

CVE-2022-42889 PoC This is Proof of Concept for the vulnerability CVE-2022-42889. This code will run the JavaScript code 195 + 324. If vulnerable the output should be: PoC Output: 519 In order to run this you will need: JDK 11 or above Maven When prompted for an exploit string, you can either...

CVE-2022-42889

CVE-2022-42889 Test application This repository contains a simple application using Apache Commons Text 1.9 which is vulnerable to CVE-2022-42889. Running the application Build and run the application via docker: docker build . -t vulnerable-app docker run vulnerable-app $ docker ps CONTAINER ID...

cve-2022-42889-intercept

cve-2022-42889-intercept For versions below Java 11, special attention is required, as higher versions have already removed the Javascript interpreter. This solution targets Java 8. Intercept illegal parameters via JVM startup parameters and jps pid. quick start -----------------------load...

cve-2022-42889

cve-2022-42889 cve-2022-42889 Text4Shell affects Apache Commons Text versions 1.5 through 1.9. It has been patched as of Commons Text version 1.10. references: https://securitylab.github.com/advisories/GHSL-2022-018ApacheCommonsText/ https://github.com/karthikuj/cve-2022-42889-text4shell-docker...

Text4shell--Automated-exploit---CVE-2022-42889

Install maven - maven-linux //For automated hacking: 1../install.sh 2../exploit.sh 3.To remove the application use ./stopapp.sh //For manual hacking: 1. Maven install to create the fat jar mvn clean install 2. Docker build docker build --tag=text4shell . 3. Docker run docker run -p 80:8080...

text4shell-exploit

text4shell-exploit A custom Python-based proof-of-concept PoC exploit targeting Text4Shell CVE-2022-42889, a critical remote code execution vulnerability in Apache Commons Text versions Example python3 text4shell.py 127.0.0.1 192.168.1.2 4444 Make sure to set up a lsitener on your attacking...

CVE-2022-33980

CVE-2022-33980 CVE Apache Commons RCE can use url,dns,script key-words to connect any server...

text4shell

text4shell A demonstration of CVE-2022-42889 text4shell remote code execution vulnerability. Details in Don't Panic!: CVE-2022-42889 Text4shell vulnerability in Apache Commons Text...

CVE-2022-33980-Apache-Commons-Configuration-RCE

CVE-2022-33980-Apache-Commons-Configuration-RCE...

CVE-2022-42889

CVE-2022-42889 Test application This repository contains a simple application using Apache Commons Text 1.9 which is vulnerable to CVE-2022-42889. Steps to reproduce the exploit. Steps to reproduce the exploit in a repo. Copy DemoApplication.java to your repo. Run the main method, with default...

CVE-2022-42889-POC

CVE-2022-42889-POC Proof of Concept for the Apache commons-text vulnerability CVE-2022-42889. What's the Issue : Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "$prefix:name", where "prefi...

text4shell-exploit

Text4shell-exploit This is a Proof of Concept exploiting the vulnerability in Apache Commons Text CVE-2022-42889 Vulnerable versions : 1.5.0 to not including 1.10.0 Impact Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary code on the vulnerable...

Text4Shell-Scanner

Scanner for CVE-2022-42889 Text4Shell Description This is a scanner for CVE-2022-42889 Text4Shell vulnerability Usage Step 1. Download jar file jar file is on preparedJar/text4shell-scanner.jar 2. Check java version on your system 3. Run jar file with args refer to the following example Sample...