CVE-2022-41923 Discussion

[mattmoss]

Issue description

This issue has been opened to facilitate discussion about CVE-2022-41923.

Technical details have not yet been released. We are providing a period of time for users to patch their applications before providing any technical details.

Patch

For information on patches, please see the Grails blog post.

Workaround

For a workaround, please see the Workaround repo.

More Information

If you have comments and/or questions, please add them here.

[Pwdrkeg]

Is this considered a local or remote vulnerability? Understanding the scope can help determine how to mitigate.

[mattmoss]

The CVSS details are here: CVSS for CVE-2022-41923

Attack vector: network
Attack complexity: low
Privileges required: none
User interaction: none

If your application is vulnerable and is exposed to the remote network/Internet, then it can be attacked remotely.

[jaabax]

I updated the plugin from version 4.0.3 to 4.0.5 and now I'm getting the following error: ExceptionLog.txt

Any ideas? Been stuck with this issue for a while now.

Thank you.

[mattmoss]

@jaabax
The base cause of that exception is that it cannot find org.springframework.web.util.UrlPathHelper.defaultInstance which is available in UrlPathHelper of the Spring Framework v5.2.9 and later.

Please check that your project has at least that version of the Spring Framework. You can determine what versions of each dependency are being used for each configuration by running a gradle dependency report.

[mattmoss]

Additional details are available from Synacktiv who discovered this issue:
https://www.synacktiv.com/sites/default/files/2023-03/Synacktiv-Grails-Spring-Security-CVE-2022-41923.pdf