CVE-2022-42899

CVE-2022-42899 Apache Common Text starting from version 15 to 19 has Remote code execution vulnerability CVE-2022-42899 final StringSubstitutor interpolator = StringSubstitutorcreateInterpolator(); interpolatorreplace("${script:javascript:javalangRuntimegetRuntime()exec('<payload to execute RCE>"); // Here you will pass payload which you wa

通过 jvm 启动参数 以及 jps pid进行拦截非法参数

cve-2022-42889-intercept 低于 Java11版本的需要注意，更高的版本已经取消了Javascript解释器 本次方案针对 Java8 通过 jvm 启动参数 以及 jps pid进行拦截非法参数 quick start -----------------------load cve-2022-42889 check start cve-2022-42889 is_deep_match orgapachecommonstextStringSubstitutor mdgetReturnType()getActualName