-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIA Semantic Attack on Google Gemini - Read the Latest Research
A Semantic Attack on Google Gemini - Read the Latest Research
Miggo AI
Miggo AIRoot Cause AnalysisThe vulnerability allowed authenticated administrators to execute arbitrary code through Groovy scripts in Object Actions and Validations. The root cause was in the ObjectScriptingExecutorImpl class, which contained an execute method that accepted a language parameter. This allowed the scripting engine to be specified dynamically. An attacker could craft an Object Action or Validation with a malicious script, and when triggered, the GroovyObjectActionExecutorImpl.execute or GroovyObjectValidationRuleEngineImpl.execute methods would call the vulnerable ObjectScriptingExecutorImpl.execute method, leading to remote code execution.
The patches remediate this vulnerability by removing the dynamic language parameter from the script execution flow. The ObjectScriptingExecutorImpl was renamed to GroovyObjectScriptingExecutor and modified to be specific to Groovy scripting, removing the ability to select a different language. The calling classes, GroovyObjectActionExecutorImpl and GroovyObjectValidationRuleEngineImpl, were updated to use this new, safer, language-specific implementation. This ensures that only Groovy scripts can be executed and only through the intended, hardened executor.
com.liferay.object.internal.action.executor.GroovyObjectActionExecutorImpl.executemodules/apps/object/object-service/src/main/java/com/liferay/object/internal/action/executor/GroovyObjectActionExecutorImpl.java
com.liferay.object.internal.validation.rule.GroovyObjectValidationRuleEngineImpl.executemodules/apps/object/object-service/src/main/java/com/liferay/object/internal/validation/rule/GroovyObjectValidationRuleEngineImpl.java
com.liferay.object.scripting.internal.executor.ObjectScriptingExecutorImpl.executemodules/apps/object/object-scripting-impl/src/main/java/com/liferay/object/scripting/internal/executor/ObjectScriptingExecutorImpl.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| com.liferay:com.liferay.object.service | maven | < 1.0.96 | 1.0.96 |