Is SiteMinder affected by Apache Commons-Text 1.9.0 (and older) vulnerability CVE-2022-42889?
Article ID: 252466
Updated On:
Products
Issue/Introduction
Symantec Siteminder Access Gateway Server ships with the following versions of Apache Commons-Text:
Access Gateway 12.8.0 - 12.8.5: Commons-Text 1.1.0
Access Gateway 12.8.6/12.8.6a: Commons-Text 1.9.0
Access Gateway 12.8.8: Commons-Text 1.10.0
Environment
PRODUCT: Symantec Siteminder
COMPONENT: Access Gateway Server
VERSIONS: r12.8.0 - r12.8.7
Cause
CVE-2022-42899: Apache Commons-Text
DESCRIPTION: Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
IMPACTED: Apache Commons-Text 1.9.0 and older
REMEDIATED: Apache Commons-Text 1.10.0
Resolution
Apache Commons-Text is NOT bundled or shipped with Apache Commons-Text:
Siteminder Policy Server
Siteminder AdminUI
Siteminder Web Agent
Siteminder Web Agent Option Pack
Siteminder SDK
Symantec Siteminder Access Gateway is the only component that is bundled with Apache Commons-Text.
You can upgrade the Siteminder Access Gateway Server to r12.8.8 in order to upgrade Apache Commons-Text to 1.10.0
Regarding Siteminder Access Gateway r12.8.7 and older, please note the following statement from Apache.org:
https://security.apache.org/blog/cve-2022-42889/
- If you rely on software that uses a version of commons-text prior to 1.10.0, you are likely still not vulnerable: you are only affected when this software uses the StringSubstitutor API without properly sanitizing any untrusted input.
- If your own software uses commons-text, double-check whether it uses the StringSubstitutor API without properly sanitizing any untrusted input. If so, an update to 1.10.0 could be a quick workaround, but the recommended solution is to also properly validate and sanitize any untrusted input.
NOTE: Siteminder Access Gateway DOES NOT use the 'StringSubstitutor API', therefore it is NOT SUSCEPTIBLE to CVE-2022-42889, even in r12.8.7 and older implementation which are still using Apache-Commons 1.9.0.
Additional Information
Feedback
