Groovy-scripting-engine-CVE-2015-1427

ElasticSearch Groovy Sandbox Bypass && Code Execution Vulnerability CVE-2015-1427 Test Environment jre version: openjdk:8-jre elasticsearch version: v1.4.2 Principle Reference articles: http://cb.drops.wiki/drops/papers-5107.html...

exploit-CVE-2015-1427

Elasticsearch 1.4.0 1.4.2 원격 코드 실행 Elasticsearch는 점점 더 많은 사용 사례를 해결할 수 있는 분산형 RESTful 검색 및 분석 엔진입니다. Elastic Stack의 핵심으로서 데이터를 중앙에 저장하여 예상한 결과를 발견하고 예상치 못한 결과를 찾아낼 수 있게 해줍니다. 취약한 환경 테스트를 위해 취약한 환경을 설정하려면 Docker가 설치되어 있어야 하며, 다음 명령어를 실행하기만 하면 됩니다: docker build -t vuln/cve-2015-1427 . docker run --...

CVE-2025-6384

CVE-2025-6384: CrafterCMS 中的 Groovy 沙盒绕过 2 Crafter CMS 的 Crafter Studio 中存在动态管理代码资源控制不当的漏洞，允许经过身份验证的开发人员通过 Groovy 沙盒绕过执行操作系统命令。 供应商披露： 该漏洞的供应商披露和修复可以在此处找到。 要求： 此漏洞需要： 有效的用户凭据 概念验证： 更多详细信息和利用过程可以在该PDF中找到。...

CVE-2022-40635

CVE-2022-40635: CrafterCMS의 Groovy 샌드박스 우회 Crafter CMS의 Crafter Studio에 존재하는 동적으로 관리되는 코드 리소스 제어 불량Improper Control of Dynamically-Managed Code Resources 취약점으로 인해 인증된 개발자가 Groovy 샌드박스 우회를 통해 OS 명령을 실행할 수 있습니다. 공급업체 공개: 이 취약점에 대한 공급업체의 공개 및 수정 사항은 여기에서 확인할 수 있습니다. 요구 사항: 이 취약점에는 다음이 필요합니다: 유효한 사용자...

CrafterCMS-CVE-2025-6384

CrafterCMS 인증된 RCE - Groovy 샌드박스 우회 CVE-2025-6384 인증된 사용자가 CrafterCMS에서 원격 코드 실행 취약점을 악용할 수 있는 개념 증명PoC입니다. 취약점 요약 개발자 권한이 있는 인증된 사용자는 Crafter Studio에서 Groovy 스크립트 샌드박스를 우회하여 원격 코드 실행을 달성할 수 있습니다. 샌드박스는 새로운 GroovyShell의 인스턴스화를 차단하지 못하며, 이를 통해 제한되지 않은 새로운 실행 환경을 만들 수 있습니다. 제품: CrafterCMS 구성 요소:...

CVE-2026-77147: Improper Control of Generation of Code

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted code in their CommandArgs static implementation, bypassing the Groovy security...

Apache Syncope permissions and access control vulnerabilities (CNVD-2026-30665)

Apache Syncope is an open-source digital identity management system, primarily used for authentication, authorization, and account management. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from insufficient protection of the Groovy security sandbox, which leads ...

Apache Syncope permissions and access control vulnerabilities (CNVD-2026-30660)

Apache Syncope is an open-source identity management platform, primarily used for user authentication, authorization, and account management in enterprise environments. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from a bypass of the Groovy security sandbox...

CVE-2026-63071 Apache Syncope: RCE via Groovy Sandbox bypass

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

Remote Code Execution (RCE)

Crafter CMS is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper control of dynamically managed Groovy code, where authenticated developers can bypass the Groovy sandbox by injecting malicious Groovy elements, allowing execution of arbitrary OS commands...

CVE-2026-1770

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

GHSA-GJ28-GW7W-3PXC Crafter CMS has Improper Control of Dynamically-Managed Code Resources

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

Crafter CMS has Improper Control of Dynamically-Managed Code Resources

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

CVE-2026-1770 Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

CVE-2026-1770 Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

EUVD-2026-5112

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

PT-2026-5681

Name of the Vulnerable Software and Affected Versions Crafter CMS versions affected versions not specified Description An issue exists in Crafter Studio of Crafter CMS that allows authenticated developers to execute operating system commands. This is due to a bypass of the Groovy Sandbox...

CVE-2026-1770: Improper Control of Dynamically-Managed Code Resources

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass sandbox restrictions and obtain RCE Remote Code...

Remote Code Execution (RCE)

CrafterCMS is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper control of dynamically-managed code resources due to a Groovy Sandbox bypass that allows authenticated developers to execute OS commands...

CVE-2025-6384 Improper Control of Dynamically-Managed Code Resources in Crafter Studio

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of CrafterCMS allows authenticated developers to execute OS commands via Groovy Sandbox Bypass. By inserting malicious Groovy elements, an attacker may bypass Sandbox restrictions and obtain RCE Remote Code...