CVE-2019-12728
📋 TL;DR
Grails versions before 3.3.10 used unencrypted HTTP connections to communicate with the SDKMan notification service, allowing man-in-the-middle attackers to intercept and potentially modify update notifications. This affects Grails framework installations using the default configuration. Note that this does NOT affect dependency resolution for user applications.
💻 Affected Systems
- Grails Framework
📦 What is this software?
Grails by Grails
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept SDKMan notifications and inject malicious update payloads or redirect users to compromised servers, potentially leading to supply chain attacks or credential theft.
Likely Case
Attackers could intercept update notifications to display fake update messages or redirect users to malicious sites, potentially leading to phishing or malware distribution.
If Mitigated
With proper network controls and HTTPS enforcement, the risk is limited to potential notification interception without data modification.
🎯 Exploit Status
Exploitation requires man-in-the-middle position on network path to SDKMan notification service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.10 and later
Vendor Advisory: https://objectcomputing.com/news/2019/05/30/possible-grails-mitm-vulnerability
Restart Required: No
Instructions:
1. Update Grails to version 3.3.10 or later. 2. Run 'grails upgrade' command. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Network-level HTTPS enforcement
allConfigure network firewalls or proxies to block HTTP connections to SDKMan notification endpoints and enforce HTTPS.
Disable SDKMan notifications
allConfigure Grails to disable SDKMan update notifications entirely.
Set 'grails.sdkman.notify=false' in application configuration
🧯 If You Can't Patch
- Implement network segmentation to isolate Grails systems from untrusted networks
- Deploy network monitoring to detect HTTP connections to SDKMan notification endpoints
🔍 How to Verify
Check if Vulnerable:
Check Grails version with 'grails --version' and verify it's below 3.3.10Check Version:
grails --versionVerify Fix Applied:
Verify Grails version is 3.3.10 or higher and check that SDKMan notifications use HTTPS📡 Detection & Monitoring
Log Indicators:
- HTTP connections to SDKMan notification endpoints
- Failed HTTPS connections followed by HTTP fallback
Network Indicators:
- Outbound HTTP traffic to SDKMan domains on port 80
- HTTP requests to notification.sdkman.io
SIEM Query:
destination_port:80 AND destination_ip:(SDKMan_IPs) AND protocol:HTTP