Skip to content

grails/GSSC-CVE-2022-41923

master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.

Workaround for CVE-2022-41923: Privilege Management Vulnerability

Summary

The vulnerability CVE-2022-41923 found in the unpatched Grails Spring Security Core (GSSC) plugin can result in improper privilege management. This repository describes how to work around the issue.

If you are using an unpatched version of the plugin, we recommend highly that you upgrade to a patched version. If you are unable to upgrade immediately, we encourage you to implement the workaround described in this document. This is especially important if you are using GSSC plugin version 2.x, as no patch is available for version 2.x.

Preparation

In order to correctly configure the workaround, you need to know:

  • The version of the GSSC plugin your application employs. Look for the version number in your build.gradle file. (For Grails 2.x, look in the BuildConfig.groovy file).

  • What security configuration type you are using: that is, the configuration value for grails.plugin.springsecurity.securityConfigType

Config Value Documentation Reference
Annotation (default) Secured Annotations
InterceptUrlMap Static Map
Requestmap Requestmap Instances

Note: In all the instructions and configuration below, the demo package is used. Change this package appropriately for your application and the location you place the patched source files.

Workaround for GSSC Plugin (versions 3.x - 5.x)

Determine the workaround class you need based on your security configuration type.

Config Value Workaround Class
Annotation PatchedAnnotationFilterInvocationDefinition
InterceptUrlMap PatchedInterceptUrlMapFilterInvocationDefinition
Requestmap PatchedRequestmapFilterInvocationDefinition

Copy the corresponding source file into your src/main/groovy source tree.

Finally, add the following configuration to your application.groovy config file, replacing PatchedAnnotationFilterInvocationDefinition with the needed workaround class.

grails.plugin.springsecurity.objectDefinitionSourceBeanClass = 'demo.PatchedAnnotationFilterInvocationDefinition'

Workaround for GSSC Plugin (version 2.x)

As above, determine the workaround class you need based on your security configuration type. Copy the corresponding source file into your src/groovy source tree. Then edit your bean configuration based on your application's security configuration type.

Security Config Type: Annotation

If using security configuration type Annotation, edit the grails-app/conf/spring/resources.groovy to include:

import demo.PatchedAnnotationFilterInvocationDefinition
import grails.plugin.springsecurity.SpringSecurityUtils

beans = {
    def conf = SpringSecurityUtils.securityConfig
    objectDefinitionSource(demo.PatchedAnnotationFilterInvocationDefinition) {
        application = ref('grailsApplication')
        grailsUrlConverter = ref('grailsUrlConverter')
        responseMimeTypesApi = ref('responseMimeTypesApi')
        boolean lowercase = conf.controllerAnnotations.lowercase
        if (conf.rejectIfNoRule instanceof Boolean) {
            rejectIfNoRule = conf.rejectIfNoRule
        }
    }

    // ... existing bean configuration ...
}

Security Config Type: Static Map

If using security configuration type InterceptUrlMap, edit the grails-app/conf/spring/resources.groovy to include:

import demo.PatchedInterceptUrlMapFilterInvocationDefinition
import grails.plugin.springsecurity.SpringSecurityUtils

beans = {
    def conf = SpringSecurityUtils.securityConfig
    objectDefinitionSource(demo.PatchedInterceptUrlMapFilterInvocationDefinition) {
        if (conf.rejectIfNoRule instanceof Boolean) {
            rejectIfNoRule = conf.rejectIfNoRule
        }
    }

    // ... existing bean configuration ...
}

Security Config Type: Requestmap Instances

If using security configuration type Requestmap, edit the grails-app/conf/spring/resources.groovy to include:

import demo.PatchedRequestmapFilterInvocationDefinition
import grails.plugin.springsecurity.SpringSecurityUtils

beans = {
    def conf = SpringSecurityUtils.securityConfig
    objectDefinitionSource(demo.PatchedRequestmapFilterInvocationDefinition) {
        if (conf.rejectIfNoRule instanceof Boolean) {
            rejectIfNoRule = conf.rejectIfNoRule
        }
    }

    // ... existing bean configuration ...
}

More Information

For additional information on this vulnerability, please see the Grails blog post.

Discussion and questions can be directed to this Grails Spring Security Core plugin issue on GitHub.

About

No description, website, or topics provided.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages