CVE-2026-47424: Forgerock OpenAM Groovy Sandbox Escalation Auth RCE Analysis & Fix

CVE-2026-47424: Authenticated RCE Vulnerability Due to Groovy Sandbox Escape Vulnerability Overview Vulnerability Type: Authenticated Remote Code Execution (Authenticated RCE) Root Cause: The Groovy sandbox ( ) failed to correctly intercept calls that launch OS processes (e.g., ) initiated via Groovy extension methods (such as ), allowing attackers to bypass the sandbox to execute arbitrary commands. Trigger Conditions: The attacker must have an authenticated identity and invoke process execution methods like through a Groovy script. Scope of Impact Affected Components: and its test class under the package. Affected Versions: Based on the commit history, the fix commit targets the branch, version number . Impact: Authenticated users can craft specific Groovy scripts to exploit the sandbox flaw and execute system commands, achieving remote code execution. Remediation Core Fix: Added an method to to determine if a method call falls under the "process launch exemption" scenario (i.e., launching an OS process via a Groovy extension method). Key Logic: - If the method name is and the receiver is a or a , it is treated as a process launch and a is thrown. - Calls to are also intercepted to prevent bypassing the sandbox via dynamic method invocation. Test Coverage: A new test class was added, using Mockito to mock the and verifying the interception behavior for and . POC / Exploitation Code (Extracted from Screenshots) 1. Core Sandbox Filter Fix Code ( ) 2. Test Code ( ) > Note: The code above represents the visible portion from the screenshots; the complete implementation may include additional edge-case handling. The core of the fix lies in using and interception to block the path for launching processes via Groovy extension methods.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-47424: Forgerock OpenAM Groovy Sandbox Escalation Auth RCE Analysis & Fix

More from this source