vivo Internet Technology
May 10, 2023 · Information Security
Detecting Apache Commons Text RCE (CVE-2022-42889) with the Doop Static Analysis Framework
The Vivo Internet Security Team demonstrates how to extend the Doop static analysis framework with custom Datalog rules to detect the Apache Commons Text CVE‑2022‑42889 remote code execution vulnerability by tracing taint from StringSubstitutor.replace to ScriptEngine.eval, producing source‑sink CSV reports and showcasing Doop’s extensibility for security research.
Apache Commons TextCVE-2022-42889Datalog
0 likes · 14 min read