Summary
LAMP Rapid Development Platform through version 5.6.2 contains a code injection vulnerability in GlueFactory, where database template fields are evaluated as unsandboxed Groovy scripts. An attacker who can write to or influence a message template field may execute arbitrary Groovy code and operating-system commands on the backend server.
Affected context
The vulnerability occurs in deployments using GlueFactory to process message templates whose script-related fields are stored in or sourced from the database. Risk increases when an attacker can create or modify templates through exposed message-template endpoints and when the backend evaluates those fields without sandboxing, compilation restrictions, or an allowlist of permitted operations.
Exploit preconditions
- Attack surface: Message template management and processing endpoints
- Required access: Ability to write, modify, or otherwise influence a database-backed template field
- Trigger point: Backend processing of the affected template by GlueFactory
- Why exploitation is possible: User-influenced content is executed as unrestricted Groovy code without effective sandboxing, compilation controls, or method and class whitelisting
Why this happens
The underlying flaw is the treatment of database-sourced template content as executable Groovy rather than as constrained data. GlueFactory evaluates the script field without enforcing a safe execution policy, allowing attacker-controlled expressions to reach powerful language and operating-system capabilities. This maps to CWE-94: Improper Control of Generation of Code, because externally influenced input is incorporated into executable code without adequate restriction.
Potential impact
- An attacker may execute arbitrary code on the backend server
- The application could be compromised or disrupted
- Sensitive files, credentials, or environment data may be exposed
- The attacker could alter application data or message-processing behavior
- The compromised server could be used for lateral movement or further attacks
General mitigation guidance
Mitigation generally centers on preventing untrusted template content from becoming executable code and reducing the privileges available to template-processing components.
Common defensive patterns include:
- Treating database template fields as data and using a constrained, non-executable templating language
- Applying strict parsing, schema validation, and allowlists to template inputs
- Using a properly isolated and policy-restricted execution environment when dynamic logic is unavoidable
- Separating template rendering from sensitive backend capabilities
- Restricting access to message-template creation and modification operations
- Running the backend with least-privilege service accounts and limited filesystem, network, and process permissions
- Avoiding secrets and administrative capabilities in the template-processing runtime
How teams detect issues like this
Detection can focus on identifying paths where database values or request-controlled fields are passed into Groovy evaluation or other dynamic code-generation APIs.
Useful approaches include:
- Static analysis rules for Groovy script compilation, evaluation, reflection, and process-execution APIs
- Code review checks for template fields that are treated as scripts or expressions
- Tracing data flow from message-template endpoints and database reads into dynamic execution sinks
- Runtime monitoring for unexpected child processes, command interpreters, file access, or outbound connections from the backend
- Policy enforcement that prohibits executable template content unless it uses an approved restricted engine
- Neutral automated security review tools to flag unsandboxed dynamic evaluation and missing allowlists
