CVE-2022-35912: Grails framework Remote Code Execution via Data Binding
Summary
CVE-2022-35912: Grails framework Remote Code Execution via Data Binding. Affects org.grails:grails-databinding across 4 version ranges.
>= 3.3.10, < 3.3.15
>= 4.0.0, < 4.1.1
>= 5.0.0, < 5.1.9
>= 5.2.0, < 5.2.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Grails framework is a popular web application framework built on top of the Groovy programming language. It provides a convenient and powerful way to develop web applications using the Java Virtual Machine (JVM). The Grails data-binding logic allows for automatic binding of request parameters to domain objects, simplifying the development process. However, a vulnerability has been discovered in the data-binding logic that can lead to remote code execution in a Grails application running on Java 8. This vulnerability affects Grails versions 3.3.10 to 3.3.15, 4.0.0 to 4.1.1, 5.0.0 to 5.1.9, and 5.2.0 to 5.2.1.
Vulnerability Detail
The vulnerability in the Grails data-binding logic allows an attacker to execute arbitrary code in a Grails application. This exploit requires the application to be running on Java 8 and can be triggered by sending specially crafted requests. The impact of this vulnerability is severe, as it allows an attacker to take control of the affected application and potentially access or modify sensitive data. It is crucial to patch the affected versions of the Grails framework to mitigate this vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.3.10, < 3.3.153.3.15 -
>= 4.0.0, < 4.1.14.1.1 -
>= 5.0.0, < 5.1.95.1.9 -
>= 5.2.0, < 5.2.15.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the patches mentioned above to fix the issue.
Conclusion
The vulnerability in the Grails data-binding logic poses a significant risk to Grails applications running on Java 8. It allows for remote code execution, potentially leading to unauthorized access or modification of sensitive data. It is crucial to upgrade to the patched versions of the Grails framework (Grails 3.3.15, Grails 4.1.1, Grails 5.1.9, or Grails 5.2.1) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.grails:grails-databinding →
FAQ
The vulnerability allows for remote code execution in a Grails application, potentially leading to unauthorized access or modification of sensitive data.
The vulnerability affects Grails versions 3.3.10 to 3.3.15, 4.0.0 to 4.1.1, 5.0.0 to 5.1.9, and 5.2.0 to 5.2.1.
No, there is no known workaround. It is necessary to apply the provided patches to fix the vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
You can find more information about this vulnerability in the official Grails blog post (https://grails.org/blog/2022-07-18-rce-vulnerability.html) and the GitHub advisory (https://github.com/grails/grails-core/issues/12626).
References
Related vulnerabilities
Recent vulnerabilities recorded for org.grails:grails-databinding.
