CrafterCMS Crafter Studio Remote Code Execution Vulnerability via Groovy Sandbox Bypass

A remote code execution vulnerability has been identified in Crafter Studio of CrafterCMS versions 4.0.0 prior to 4.2.2. This vulnerability arises from an improper control of dynamically-managed code resources, allowing authenticated developers to execute operating system commands by bypassing Groovy Sandbox restrictions. By inserting malicious Groovy elements, an attacker can exploit this issue to gain remote code execution.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where CrafterCMS is running.