Grails web framework, intended for the development of web applications according to the MVC paradigm on Java, Groovy, and other languages for the JVM, has a vulnerability that allows remote code execution in the environment where the web application runs. Exploiting the vulnerability is carried out by sending a specially crafted request, granting the attacker access to the ClassLoader. This issue is caused by a flaw in the data-binding logic used both for object creation and manual binding using bindData. The issue has been fixed in versions 3.3.15, 4.1.1, 5.1.9, and 5.2.1.
Additionally, there is a vulnerability in the Ruby module tzinfo, which allows loading the contents of any file, subject to the access rights of the attacked application. The vulnerability is related to a lack of proper validation regarding the use of special characters in the timezone name specified in the TZInfo::Timezone.get method. This issue affects applications that pass unverified external data to TZInfo::Timezone.get. For instance, to read the file /tmp/payload, one might specify a value like "foo\n/../../../../tmp/payload".
Avots: opennet.lv
