Grails® framework RCE via Data Binding - CVE-2022-35912

[puneetbehl]

Issue description

I am opening this issue to facilitate the discussion about this. More information available at https://grails.org/blog/2022-07-18-rce-vulnerability.html

[erichelgeson]

Could you provide an example of the vulnerability (I don't see any tests or info in the CVE)? I need to backport this to 3.3.9 as there are breaking changes preventing me from moving to anything higher and would like to test it works. I assume these are the only changes required? c8bb44e

[williamhbutt]

Any idea if this affects grails 2 versions?

[bmplcm]

Any idea if this affects grails 2 versions?

Had the same question before. Here's all that I could find about it: https://twitter.com/JasonTypesCodes/status/1548971229897433088

[JasonTypesCodes]

@erichelgeson

Could you provide an example of the vulnerability (I don't see any tests or info in the CVE)?

We haven't yet published the technical mechanics of this attack yet as we are trying to provide folks some time to upgrade before the attack becomes more broadly known. We will be publishing the details soon. We are identifying a timeline for that to become public.

I need to backport this to 3.3.9 as there are breaking changes preventing me from moving to anything higher

If you aren't able to upgrade your application, for a 3.3.9 app you could get the patched databinding library by adding the updated dependency explicitly to your build.gradle:

compile "org.grails:grails-databinding:3.3.15"

[nair-rajeev]

Hi @JasonTypesCodes. Will the above mentioned patched 3.3.15 version of databinding library work in Grails 2.5.6 environment?

[Jwalker107]

As a systems administrator (not developer), what's the best method to detect vulnerable versions? A filesystem scan for
grails-databinding-5.2.x.jar? Along with
5.2 less than 5.2.1, 5.1 less than 5.1.9, 4.1 less than 4.1.1, and 3.3 less than 3.3.15? Is that the correct naming convention?

[JasonTypesCodes]

We have identified the change that allows this attack to succeed, and it was added in version 3.3.10. Grails framework versions below 3.3.10 are not vulnerable to this specific attack. Due to the nature of the attack, it is possible that a variation could be discovered that does impact Grails framework versions 3.3.9 and lower. We strongly suggest that all Grails applications be upgraded to a patched and supported version of the framework. More info is on the updated blog post: https://grails.org/blog/2022-07-18-rce-vulnerability.html

(cc @erichelgeson )

[JasonTypesCodes]

@nair-rajeev

Hi @JasonTypesCodes. Will the above mentioned patched 3.3.15 version of databinding library work in Grails 2.5.6 environment?

That is quite a jump. I would not expect that to work. Even if it builds and runs, there are likely other breaking changes in the way that databinding is handled that may impact you.

[JasonTypesCodes]

@Jwalker107

As a systems administrator (not developer), what's the best method to detect vulnerable versions? A filesystem scan for grails-databinding-5.2.x.jar? Along with 5.2 less than 5.2.1, 5.1 less than 5.1.9, 4.1 less than 4.1.1, and 3.3 less than 3.3.15? Is that the correct naming convention?

The full known set of impacted versions are: >= 3.3.10 & < 3.3.15 ; >= 4.0.0 & < 4.1.1 ; >= 5.0.0 & < 5.1.9 ; 5.2.0

I can't say if this is the "best method" for your environment, but looking for a grails-databinding.jar in those version ranges should work. Please note that in most cases these applications will be packaged as a war which includes the jar inside of it so it may not be visible on the filesystem without extracting the contents of the war file.

[rewardone]

Potentially similar to the spring4shell issue, is an up to date version of Tomcat a mitigation for this?

If so, will specific versions of Tomcat be listed as a prerequisite for this vector?

[chrismyers81]

Or, any mitigating steps that can be applied in the interim while we wait for vendor upgrades?

[bmplcm]

Potentially similar to the spring4shell issue, is an up to date version of Tomcat a mitigation for this?

If so, will specific versions of Tomcat be listed as a prerequisite for this vector?

Note that, just like spring4shell, the key aspect is the access to the classloader. Upgrading tomcat addressed one of the attack vectors in spring4shell, but once you are able to modify anything in the classloader, there are multiple attack vectors that can be explored.

[nair-rajeev]

@nair-rajeev

Hi @JasonTypesCodes. Will the above mentioned patched 3.3.15 version of databinding library work in Grails 2.5.6 environment?

That is quite a jump. I would not expect that to work. Even if it builds and runs, there are likely other breaking changes in the way that databinding is handled that may impact you.

Thank you @JasonTypesCodes

[mkobel]

What about just adding the patched file to the src folder? This should override the vulnerable file from the library. Is this a acceptable workaround to patch older projects to gain some more time to upgrade?