CyberRota Analysis
AI-GeneratedThe Java runtime in Nuclio versions prior to 1.16.5 is vulnerable due to improper handling of template rendering, allowing attackers to inject arbitrary Groovy statements during the Gradle configuration phase. This can lead to unauthorized code execution, posing a significant risk to applications utilizing this serverless framework. Organizations using affected versions should prioritize upgrading to 1.16.5 or later to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. This issue has been patched in version 1.16.5.