GHSA-6rh6-x8ww-9h97 Grails framework Remote Code Execution via Data Binding

• Maven org.grails:grails-databinding: >= 3.3.10, < 3.3.15 → fixed in 3.3.15 • Maven org.grails:grails-databinding: >= 4.0.0, < 4.1.1 → fixed in 4.1.1 • Maven org.grails:grails-databinding: >= 5.0.0, < 5.1.9 → fixed in 5.1.9 • Maven org.grails:grails-databinding: >= 5.2.0, < 5.2.1 → fixed in 5.2.1

Impact A vulnerability has been discovered in the Grails data-binding logic which allows for Remote Code Execution in a Grails application. This exploit requires the application to be running on Java 8, either deployed as a WAR to a servlet container, or an executable JAR. Patches Grails framework versions 5.2.1, 5.1.9, 4.1.1, and 3.3.15 References https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35912 https://grails.org/blog/2022-07-18-rce-vulnerability.html For more information If you have any questions or comments about this advisory: • https://grails.org/blog/2022-07-18-rce-vulnerability.html • https://github.com/grails/grails-core/issues/12626 • Email us at [email protected] Credit This vulnerability was discovered by meizjm3i and codeplutos of AntGroup FG Security Lab