7.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-6384

CVE-2025-6384: Crafter Studio Groovy Sandbox Bypass

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass.

By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE (Remote Code Execution).

This issue affects CrafterCMS: from 4.0.0 through 4.2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-6384

CVE-2025-6384:

7.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.craftercms:crafter-studio	maven	>= 4.0.0, < 4.3.0	4.3.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Groovy sandbox bypass in Crafter Studio, which allows an authenticated developer to achieve Remote Code Execution (RCE). The root cause is an inadequate blacklist of dangerous Java and Groovy methods within the sandbox environment. An attacker can craft a Groovy script that calls these unrestricted methods to execute arbitrary OS commands or Java code.

The provided patch addresses the vulnerability by adding several dangerous methods and constructors to the sandbox's blacklist file, src/main/resources/crafter/studio/groovy/blacklist. The functions identified as vulnerable are the ones that were added to this blacklist, as their prior absence was what allowed the sandbox escape. These include methods for process creation (java.lang.ProcessBuilder), command execution (freemarker.template.utility.Execute), and dynamic code evaluation (jdk.jshell.JShell, groovy.util.Eval).

While the patch does not modify any Java code, the blacklist itself contains a reference to org.craftercms.studio.impl.v2.service.scripting.internal.ScriptingServiceInternalImpl, strongly suggesting this class is responsible for handling Groovy script execution and enforcing the sandbox rules. Therefore, the core of the vulnerability lies within a method in this class that executes scripts without properly sanitizing them against these dangerous calls.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.