A Vulnerability in the Grails Framework Could Allow for Remote Code Execution (CVE-2022-35912)

MS-ISAC ADVISORY NUMBER:

2022-096

DATE(S) ISSUED:

07/30/2022

OVERVIEW:

A vulnerability have been discovered in the Grails Framework which could allow for remote code execution. Grails is backend Apache Groovy framework. Successful exploitation of this vulnerability, could allow a user to execute code in the context of the Grails application.

SYSTEMS AFFECTED:

Grails framework versions 3.3.10 - 3.3.15
Grails framework versions 4.0.0-4.1.1
Grails framework versions 5.0.0-5.1.9
Grails framework versions 5.2.0

RISK:

Government:

Large and medium government entitiesHIGH

Small governmentHIGH

Businesses:

Large and medium business entitiesN/A

Small business entitiesHIGH

Home Users:

LOW

TECHNICAL SUMMARY:

A vulnerability have been discovered in the Grails Framework (CVE-2022-35912) which could allow for remote code execution. Details of this vulnerability are as follows:

Tactic: Execution (TA00041):
Technique: Native Code (T1575):

CVE-2022-35912 – A vulnerability in a section of the Grails data-binding logic which enables an attack to issue a specially crafted web request to execute code of their own choosing.

Successful exploitation of this vulnerability, could allow a user to execute code in the context of the Grails application.

RECOMMENDATIONS:

We recommend the following actions be taken:

Apply appropriate patches provided by the Grails team to vulnerable systems, immediately after appropriate testing. (M1051: Update Software)
o Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
o Safeguard 7.4: Perform Automated Application Patch Management: Perform application updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.
o Safeguard 7.5: Perform Automated Vulnerability Scans of Internal Enterprise Assets: Perform automated vulnerability scans of internal enterprise assets on a quarterly, or more frequent, basis. Conduct both authenticated and unauthenticated scans, using a SCAP-compliant vulnerability scanning tool.
Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources. Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources. (M1017: User Training)
o Safeguard 14.1: Establish and Maintain a Security Awareness Program: Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise’s workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.
o Safeguard 14.2: Train Workforce Members to Recognize Social Engineering Attacks: Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.
Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring. (M1050: Exploit Protection)
Safeguard 10.5: Enable anti-exploitation features on enterprise assets and software, where possible, such as Apple® System Integrity Protection (SIP) and Gatekeeper™.