PT-2021-23360 · Gradle · Gradle Enterprise

Marat Aytuganov · Published 2021-10-27 · Updated 2021-11-03 · CVE-2021-41619

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Gradle Enterprise versions prior to 2021.1.2

Description The issue concerns potential remote code execution via the application startup configuration. The installation configuration user interface, available to administrators, allows specifying arbitrary Java Virtual Machine startup options. Some options, such as -XX:OnOutOfMemoryError, allow specifying a command to be run on the host. This can be abused to run arbitrary commands on the host if an attacker gains administrative access to the application.

Recommendations For Gradle Enterprise versions prior to 2021.1.2, update to version 2021.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the installation configuration user interface to prevent potential abuse of the Java Virtual Machine startup options. Avoid using options like -XX:OnOutOfMemoryError that allow specifying commands to be run on the host until the issue is resolved.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2021-41619

Affected Products

Gradle Enterprise

References · 6

• https://osv.dev/vulnerability/CVE-2021-41619 · Vendor Advisory
• https://security.gradle.com/advisory/2021-08 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41619 · Security Note
• https://security.gradle.com · Vendor Advisory
• https://t.me/cvenotify/22473 · Telegram Post
• https://t.me/cibsecurity/31279 · Telegram Post