Ambionics / Web Exploitation
Grails PDF Plugin XXE
Tue 21 February 2017
Some times ago the Ambionics team encountered a very old instance of Grails which contained a plugin to generate PDFs from Groovy templates. Upon looking for the plugin's source code we discovered an XXE vulnerability.