A Grails web framework, designed for web application development following the MVC paradigm on Java, Groovy, and other JVM languages, has a vulnerability allowing remote code execution in the environment where the web application runs. The exploitation of this vulnerability occurs by sending a specially crafted request that provides the attacker access to the ClassLoader. The issue is caused by a flaw in the data-binding logic used both during object creation and manual binding through bindData. The problem has been resolved in releases 3.3.15, 4.1.1, 5.1.9, and 5.2.1.
Additionally, a vulnerability in the Ruby module tzinfo can be noted, which allows the loading of the contents of any file, subject to the access rights of the attacked application. The vulnerability is related to the lack of proper validation of special characters in the timezone name specified in the TZInfo::Timezone.get method. This issue affects applications that pass untrusted external data to TZInfo::Timezone.get. For instance, to read the file /tmp/payload, a value like "foo\n/../../../../tmp/payload" can be specified.
Forrás: opennet.ru
