Junglewise Threat Intelligence

CVE-2016-6521: Grails Console CSRF in Groovy code execution endpoint

CVE-2016-6521 · Severity: high · CVSS 8.8 · Published 2017-01-23

Executive brief

The Grails Console plugin, a tool used by developers and administrators to interact with Grails web applications, is vulnerable to a security flaw that allows attackers to execute malicious code. By tricking an authenticated administrator into visiting a malicious website, an attacker can secretly send commands to the console to run arbitrary scripts on the server. This could lead to a full system takeover, unauthorized data access, or complete service disruption.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Grails Console (also known as Grails Debug Console or Grails Web Console) plugin. The vulnerability stems from a lack of proper CSRF token validation; specifically, an initial attempt to fix the issue failed because the validation check compared a missing header to a null session token, allowing the check to pass if the console had not yet been visited in the current session. A remote attacker can exploit this by inducing an authenticated administrator to visit a malicious webpage, which then submits a forged request to the console's execution endpoint. Successful exploitation allows the attacker to execute arbitrary Groovy code with the privileges of the application, potentially leading to full remote code execution (RCE). The issue is addressed in versions 1.5.10 and 2.0.7 and later.

Affected products

  • sheehan Grails Console plugin <= 1.5.9, <= 2.0.6

Timeline

  • 2016-07-01: disclosed: Initial issue reported on GitHub
  • 2016-08-01: advisory: CVE requested via oss-security mailing list
  • 2016-08-03: other: Researcher reports that initial fix was incomplete
  • 2017-01-23: advisory: NVD publication date

References