CVE-2022-33980: Apache Commons Configuration default interpolators allow code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCritical CVSS (9.8) with no authentication or interaction required and a high EPSS percentile, though no confirmed in-the-wild exploitation or KEV listing.

What it is

Apache Commons Configuration versions 2.4 through 2.7 ship default Lookup interpolators (script, dns, url) that are enabled out of the box. When an application interpolates untrusted configuration values, the script lookup can execute arbitrary code via the JVM script engine, and the dns and url lookups can trigger outbound requests. The flaw matters because interpolation is a normal, expected feature, so exposure depends on whether any attacker-influenced value reaches it.

Impact

An attacker who controls an interpolated configuration value can achieve remote code execution in the application's JVM, or force the server to resolve DNS names and fetch remote URLs, enabling data exfiltration and SSRF-style access to internal services.

Attack surface

Reached over the network through any application path that feeds untrusted input into Commons Configuration interpolation; the CVSS vector indicates no authentication and no user interaction are required. The record does not identify which specific endpoints or products expose that path.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at roughly 0.45 (98.7th percentile), and references are advisory and mailing-list entries only, with no public exploit tag.

What to do

• Upgrade Apache Commons Configuration to 2.8.0 or later, which disables the script, dns and url interpolators by default.
• If upgrade is not immediately possible, remove or disable the script, dns and url Lookup instances from the interpolator configuration.
• Audit application code and configuration for places where untrusted input reaches variable interpolation, and validate or reject ${...} patterns in that input.
• Track vendor advisories for NetApp SnapCenter and Debian packages that bundle the affected library and apply their updates.
• Restrict outbound network access from application servers to limit the impact of the dns and url lookups.

Detection

• Search application and dependency inventories for commons-configuration2 versions 2.4 through 2.7.
• Monitor application logs and process behavior for JVM script engine invocation or unexpected script evaluation triggered by configuration parsing.
• Alert on outbound DNS and HTTP requests originating from application servers that correlate with configuration or input processing.
• Review configuration sources and request parameters for literal ${script:, ${dns: or ${url: patterns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.