Build-time RCE via unescaped Groovy injection in Java Gradle repositories (GHSA-3v79-m2cg-89ww)

Vulnerability Summary: CVE-2024-XXXX (GHSA-3v79-m2cg-89ww) Overview Type: Build-time Remote Code Execution (Build-time RCE) Root Cause: In the script generated by the Java runtime, user-controllable values from are embedded verbatim as Groovy string literals without escaping or validation. An attacker can execute arbitrary Groovy/Gradle code during the build phase by crafting malicious repository names (e.g., , ). Trigger Point: In , the function renders into the Groovy DSL template. Scope of Impact Affected Component: (Java Build Processor) Affected Versions: Prior to (the fix is mentioned in the PR for ) Affected Scenarios: Java projects utilizing custom or custom repository configurations (e.g., private Maven repositories) Attack Vectors: Injection via , for example: - - - - Fix Details Fix PR: (Merged) Fix Contents: 1. Structural validation of each value within : - Only strings matching (i.e., valid Maven repository names) are allowed. - Strings containing characters such as , , , , , , , , , , , , , , , , , , , , , , , , , are rejected. 2. If validation fails, an error is thrown immediately, halting the build process (fail-fast). 3. Documentation has been updated to clarify that repository names must be declared as parameterless functions, and custom repositories must be provided via . Test Coverage: - New unit tests added in , covering: - Valid repository names (e.g., , , ) - Invalid repository names (e.g., , , ) - Edge cases such as empty values, pure whitespace, and strings containing special characters Regression Test: passed POC / Exploitation Code (Extracted from PR) References Ticket: (Internal Link) Advisory: PR: (Merged into ) Branch:

Goal Reached Thanks to every supporter — we hit 100%!

Build-time RCE via unescaped Groovy injection in Java Gradle repositories (GHSA-3v79-m2cg-89ww)

More from this source