martinfrancois/cve-2018-1000529Proof-of-concept for CVE-2018-1000529: stored XSS in Grails Fields plugin <=2.2.7. Demonstrates the vulnerability with a runnable Grails application and includes disclosure timeline.
NVD CVE-2018-1000529: https://nvd.nist.gov/vuln/detail/CVE-2018-1000529
MITRE CVE-2018-1000529: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1000529
This repository was used to demonstrate a proof of concept of the vulnerability for the responsible disclosure to the Grails team.
The XSS vulnerability is present in all projects using Grails v3.3.5 and below, since they all include the affected Grails Fields plugin v2.2.7 and below. It was fixed in the Grails Fields plugin v2.2.8, which is being used in Grails v3.3.6.
All projects using Grails v3.3.5 or lower are recommended to upgrade to at least v3.3.6 or to define the version of the Grails Fields plugin dependency in build.gradle to be v2.2.8 or higher.
Since the Grails Fields plugin is widely used in Grails Scaffolding, all scaffolded applications using Grails v3.3.5 and below are potentially vulnerable. Even though Grails has good XSS countermeasures in place by default, any domain objects being displayed by tags of the Grails Fields plugin containing HTML or JavaScript code are not being encoded or validated and are getting executed by the browser.
Clone this project and then start the application locally by running:
In a command prompt / powershell:
grailsw.bat run-app
In a terminal window:
./grailsw run-app
When the Grails application is fully initialized, it will display:
Grails application running at http://localhost:8080 in environment: development
myapp.TestControllerXSS will open.The domain object Test1 is being created during initialization and is defined in the grails-app/init/myapp/BootStrap.groovy file.
The vulnerability is not only present when the object is being created during BootStrap, but also when being created in the scaffolded GUI by user input.
This can be tested by removing the Test1 object and adding a new Test object containing the name: Test1<script>alert('XSS');</script>
Thanks a lot to the Grails team for quickly resolving this vulnerability, including: