ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks

Summary

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the `rule engine`'s Groovy script test/register flow. This issue is fixed in version 1.4.0.

Remediation

1. Inventory every mqttsnet thinglinks deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/mqttsnet/thinglinks/security/advisories/GHSA-9vph-5ccx-qp9v
• Referencehttps://github.com/mqttsnet/thinglinks/commit/311ee760dad798f48652722989fcea02349e13a3
• Referencehttps://github.com/mqttsnet/thinglinks/releases/tag/v1.4.0