QID 376843

Grails is an open source web application framework that uses the Apache Groovy programming language. It is intended to be a high-productivity framework by following the "coding by convention" paradigm, providing a stand-alone development environment and hiding much of the configuration detail from the developer.

CVE-2022-35912: The vulnerability allows an attacker to remotely execute code within a Grails application runtime by issuing a specially crafted web request that grants the attacker access to the class loader. This attack exploits a section of the Grails data-binding logic.

Affected Versions:
Grails framework version 5.2.0
Grails framework versions from 5.0.0 prior to 5.1.9
Grails framework versions from 4.0.0 prior to 4.1.1
Grails framework versions from 3.3.10 and prior to 3.3.15

NOTE:
Vulnerability only exists if application is using embedded Tomcat runtime, as well as those deployed to a Servlet Container and running on java 8.

QID Detection Logic (Authenticated): Checks for vulnerable versions of Grails Framework installed along with running java version by executing command "grails -version".
Detection requires the path to binaries exist in environment path variables.

Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code on the target system.