CVE-2016-6814

Cuando una aplicación con versiones de Codehaus no soportadas de Groovy desde la versión 1.7.0 hasta la 2.4.3 o Apache Groovy desde la versión 2.4.4 hasta la 2.4.7 en classpath usa mecanismos estándar de serialización de Java (por ejemplo, para comunicarse entre servidores o almacenar datos locales), un atacante pudo preparar un objeto especialmente serializado que ejecutará código directamente al ser deserializado. Todas las aplicaciones que dependen de la serialización y no aíslan el código que deserializa objetos estaban sujetos a esta vulnerabilidad.

It was found that a flaw in Apache groovy library allows remote code execution wherever deserialization occurs in the application. It is possible for an attacker to craft a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects are subject to this vulnerability.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Groovy. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on implementation.
The specific flaw exists within the handling of serialized MethodClosure objects. A crafted stream of bytes, when deserialized, can result in the creation of an unsafe instance of MethodClosure. An attacker can leverage this vulnerability to execute arbitrary code under the context of the current process.