CVE-2023-35946: Gradle Path Traversal Vulnerability

CVE-2023-35946 Overview

CVE-2023-35946 is a path traversal vulnerability in Gradle, a build automation tool used across multi-language development projects. When Gradle writes a dependency into its dependency cache, it derives the destination file path from the dependency's coordinates. Specially crafted coordinates can force Gradle to write files outside the cache or overwrite existing files within it. The flaw is tracked as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Exploitation requires an attacker to control a dependency repository consumed by the build or to modify the build configuration. Successful abuse enables dependency cache poisoning or overwriting of files where the Gradle process has write permissions.

Critical Impact

Attackers with control over a dependency source can write arbitrary files on the build host, poisoning the dependency cache and corrupting integrity of downstream builds.

Affected Products

• Gradle versions prior to 7.6.2
• Gradle 8.x versions prior to 8.2
• Build environments consuming untrusted dependency repositories

Discovery Timeline

• 2023-06-30 - CVE-2023-35946 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-35946

Vulnerability Analysis

Gradle constructs filesystem paths inside its dependency cache directly from dependency coordinates such as group, artifact, and version. The code paths responsible for caching did not validate these coordinate components for path traversal sequences. An attacker controlling the coordinates can embed ../ segments that escape the intended cache directory.

The result is a write-primitive constrained by the permissions of the Gradle process. On developer workstations and CI runners, that process typically holds write access to source trees, build artifacts, and shell startup files. The integrity impact is high while confidentiality and availability are not directly affected.

Root Cause

The root cause is missing input sanitization on dependency coordinates used to compute cache file destinations. Gradle treated coordinate strings as trusted identifiers rather than untrusted input. The fix in commits 859eae2 and b07e528 causes Gradle to refuse to cache dependencies whose coordinates contain path traversal elements.

Attack Vector

An attacker must either control a dependency repository the build resolves against or have the ability to alter the build's configuration. The attacker publishes a malicious artifact whose coordinates include traversal sequences. When Gradle resolves and caches the dependency, the manipulated path causes the artifact bytes to be written to an attacker-chosen location. Targets include cache entries for legitimate libraries, shell configuration files, or scripts executed by CI runners. The GitHub Security Advisory GHSA-2h6c-rv6q-494v documents the issue in detail.

// No verified public proof-of-concept code is available for CVE-2023-35946.
// Refer to the upstream advisory for technical details:
// https://github.com/gradle/gradle/security/advisories/GHSA-2h6c-rv6q-494v

Detection Methods for CVE-2023-35946

Indicators of Compromise

• Unexpected files appearing outside the ~/.gradle/caches/modules-2/ directory after dependency resolution
• Modifications to legitimate cached artifacts whose checksums no longer match upstream repository values
• Build log entries showing dependency coordinates containing .., /, or \ characters
• Use of unfamiliar or non-corporate Maven or Ivy repositories in build.gradle or settings.gradle

Detection Strategies

• Audit build.gradle, settings.gradle, and init.gradle files for repository declarations pointing to untrusted hosts
• Compare cached artifact hashes against authoritative upstream checksums to detect cache poisoning
• Inspect Gradle wrapper scripts and version pinning to confirm builds run on 7.6.2, 8.2, or later

Monitoring Recommendations

• Enable filesystem auditing on CI build agents for writes outside the configured Gradle cache directory
• Log and alert on outbound Gradle traffic to dependency repositories not on an approved allowlist
• Track changes to build configuration files in source control with mandatory code review

How to Mitigate CVE-2023-35946

Immediate Actions Required

• Upgrade Gradle to version 7.6.2, 8.2, or later across all developer workstations and CI/CD runners
• Enable Gradle dependency verification to enforce checksum and signature validation
• Restrict repository declarations to vetted internal proxies and trusted public registries
• Inventory existing Gradle caches and rebuild from clean state if cache poisoning is suspected

Patch Information

Gradle released fixes in versions 7.6.2 and 8.2. The patched code rejects dependency coordinates containing path traversal elements before any cache write occurs. Review the upstream commits 859eae2 and b07e528, and the GitHub Security Advisory GHSA-2h6c-rv6q-494v. NetApp published downstream guidance in NTAP-20230731-0003.

Workarounds

• Enable dependency verification to make exploitation significantly more difficult on unpatched versions
• Limit repositories {} blocks to internal artifact repositories such as Artifactory or Nexus that enforce coordinate validation
• Run builds under least-privileged accounts to reduce the blast radius of an arbitrary file write

# Enforce dependency verification in gradle/verification-metadata.xml
./gradlew --write-verification-metadata sha256 help

# Pin Gradle wrapper to a patched release
./gradlew wrapper --gradle-version 8.2