Apache Commons Configuration insecure interpolation defaults

Vulnerability

Overview Apache Commons Configuration versions 2.4 to 2.7 include variable interpolation defaults that can be abused to achieve remote code execution or make unintended network requests. The library processes ${prefix:name} expressions, where the prefix selects a Lookup instance. By default, the "script" Lookup executes arbitrary code via the JVM script engine (javax.script), the "dns" Lookup resolves DNS records, and the "url" Lookup fetches content from remote URLs [1][2]. Applications that interpolate untrusted configuration values using these defaults are at risk.

Exploitation and

Attack Surface Exploitation requires an attacker to inject a malicious ${script:...}, ${dns:...}, or ${url:...} expression into a configuration value that the application subsequently evaluates. No special privileges beyond the ability to supply configuration input (such as environment variables, system properties, or configuration files) are needed. The vulnerability is reachable through any application path that uses Commons Configuration's default interpolation capability [2][3].

Impact

A successful exploit can lead to full remote code execution on the server running the application, enabling data theft, lateral movement, or further compromise. Additionally, the url Lookup can be used to perform server-side request forgery (SSRF), potentially accessing internal services or exfiltrating data. The dns Lookup may be used for data exfiltration or reconnaissance [1][2].

Mitigation

Users should upgrade to Apache Commons Configuration 2.8.0 or later, which disables the dangerous interpolators by default. No workaround is provided for earlier versions; upgrading is the recommended course of action [2][3].