Apache Commons Text detection scan (Linux)
Log In or Register to download the BES file, and more.

0 Votes

Description

This is Community Content. When you use these solutions, it is incumbent on your organization to test any solutions provided across the broadest available system base including various OS, storage solutions, and application inventory.

Please see the Community Solution Testing Statement

This Task performs a filesystem scan on Linux systems to attempt detecting Apache Commons Text versions vulnerable to CVE-2022-42889.

 

This Task performs a filesystem search across all fixed disks on Linux platforms, to locate Apache Commons Text JAR files, either directly on the filesystem or embedded in a .WAR archive file.  In the case any .WAR file is found on the system, the 'unzip' utility is used to perform a listing of files inside the archive to locate Apache Commons Text-related JAR files.  Specifically, this Task searches for any versions of commons-text-X.X.X.jar.

Scan results are stored in a "Scans" subdirectory beneath the "BES Client" folder. 'apache-commons-text.log' contains the full script output for potential debugging or diagnosis, and 'apache-commons-text.txt' contains a listing of detected files in one of the forms

  • /tmp/commons-text/1.4/commons-text-1.4.jar
  • /tmp/commons-text.war::commons-text/1.10.0/commons-text-1.10.0.jar

The first sample entry indicates a detected .jar file directly in the filesystem, while the second entry indicates a detected .jar file embedded within a .WAR archive.

This Task has several known limitations:

  • Archives are not extracted recursively - only .JAR files contained directly within a .WAR archive are found; archives embedded within multiple layers of .WAR archives are not detected.
  • There is no option to throttle the scan in terms of processor or disk i/o usage.  Scans should be executed during non-critical hours, and staggered over time especially where multiple systems share a storage resource, such as a SAN or virtual machine storage pool.

This detection method uses Linux Bash script with external dependencies on 'df', 'find', 'sed', and 'unzip'.  Results of the scan may be retrieved using the related Analysis.


Property Details

ID26954
StatusBeta - Preliminary testing ready for more
TitleApache Commons Text detection scan (Linux)
DomainBESC
SourceInternal
Source Release Date3/31/2022 12:00:00 AM
KeywordsApache Commons Text, commons-text, scan, vulnerability, CVE-2022-42889
Is TaskTrue
Added by on 10/21/2022 12:01:55 PM
Last Modified by on 10/21/2022 12:01:55 PM
Counters 858 Views / 6 Downloads
User Rating 1 star 2 star 3 star 4 star 5 star * Average over 0 ratings. ** Log In or Register to add your rating.

Relevance

Used in 6 fixlets   * Results in a true/false
Show indented relevance
name of operating system as lowercase contains "linux"
Used in 3 fixlets   * Results in a true/false
Show indented relevance
(if exists property "in proxy agent context" then not in proxy agent context else true)

Actions

Action 1 (default)

Action Link Click here to deploy this action.
Script Type BigFix Action Script
parameter "ScansFolder" = "{(if (version of client >= "9" as version) then (pathname of parent folder of data folder of client) else (pathname of parent folder of parent folder of client folder of site "actionsite"))}/Scans"
folder create "{parameter "ScansFolder"}"
parameter "output"="{pathname of folder (parameter "ScansFolder")}/apache-commons-text.txt"
parameter "exec_output"="{pathname of folder (parameter "ScansFolder")}/apache-commons-text.log"
delete "{parameter "output"}"
delete "{parameter "exec_output"}"

delete __createfile
createfile until EOF_EOF_EOF_EOF
#!/bin/sh

# Enable trace output from script
set -o xtrace

OUTPUT_FILE={parameter "output"}

handle_file() {{
echo Handling $1
case $1 in
*.war|*.zip|*.ear|*.WAR|*.ZIP|*.EAR)
echo "${{1} is an archive, searching content via unzip";
for embeddedfile in `unzip -Z -1 "$1" *commons-text-*.jar -x *-sources.jar *-javadoc.jar *-tests.jar`
do
echo ${{1}::${{embeddedfile}>>${{OUTPUT_FILE}
done
;;
*)
echo ${{1}>>${{OUTPUT_FILE}
;;
esac
}



for j in `df -l --output=target -x tmpfs -x devtmpfs | sed 1d`

do echo "searching $j"
for targetfile in `find $j -xdev \( -name "commons-text-*.jar" -o -name "*.war" \) -a ! \( -name "*-sources.jar" -o -name "*-javadoc.jar" -o -name "*-tests.jar" \)`
do handle_file "$targetfile"
done

done



EOF_EOF_EOF_EOF

delete run_scan.sh
copy __createfile run_scan.sh
wait chmod +x run_scan.sh
wait /bin/sh -x -c "./run_scan.sh > '{parameter "exec_output"}' 2>&1"
Success Criteria

This action will be considered successful when the applicability relevance evaluates to false.


Sharing

Social Media:
Share this page on Yammer

Comments

Log In or Register to leave comments!