A vulnerability has been identified in the Grails web framework, designed for developing web applications in accordance with the MVC paradigm on Java, Groovy, and other JVM languages, which allows for remote code execution in the environment where the web application runs. Exploitation of this vulnerability is achieved by sending a specially crafted request, granting the attacker access to the ClassLoader. The issue arises from an oversight in the data-binding logic used both during object creation and manual binding through bindData. The problem has been corrected in releases 3.3.15, 4.1.1, 5.1.9, and 5.2.1.
Additionally, a vulnerability in the Ruby tzinfo module allows for loading the content of any file as permitted by the permissions of the attacked application. This vulnerability is related to the lack of proper validation for special characters in the timezone name specified in the TZInfo::Timezone.get method. The issue affects applications that pass unverified external data to TZInfo::Timezone.get. For example, to read the file /tmp/payload, a value like 'foo\n/..//..//..//tmp/payload' can be specified.
Izvor: opennet.ru
