Add reachable CVE-2022-42889 (Text4Shell) via commons-text 1.9

pom.xml

@@ -31,6 +31,11 @@
       <artifactId>commons-io</artifactId>
       <version>2.11.0</version>
     </dependency>
+    <dependency>
+      <groupId>org.apache.commons</groupId>
+      <artifactId>commons-text</artifactId>
+      <version>1.9</version>
+    </dependency>
     <dependency>
       <groupId>commons-codec</groupId>
       <artifactId>commons-codec</artifactId>

src/main/java/demo/security/servlet/TemplateServlet.java

@@ -0,0 +1,27 @@
+package demo.security.servlet;
+
+import org.apache.commons.text.StringSubstitutor;
+
+import javax.servlet.ServletException;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.io.PrintWriter;
+
+@WebServlet("/template")
+public class TemplateServlet extends HttpServlet {
+
+    protected void doGet(HttpServletRequest request, HttpServletResponse response)
+            throws ServletException, IOException {
+        String template = request.getParameter("template");
+        // CVE-2022-42889: StringSubstitutor with user-controlled input allows
+        // arbitrary code execution via script/dns/url lookups
+        String result = StringSubstitutor.replaceSystemProperties(template);
+        response.setContentType("text/html");
+        PrintWriter out = response.getWriter();
+        out.print("<p>" + result + "</p>");
+        out.close();
+    }
+}