Grails database console - Vulnerability Database

Grails database console

Description

The Grails framework includes a built-in database console accessible at /dbconsole/, which is enabled by default in development mode. This interactive web interface allows direct execution of SQL queries and provides visibility into the database schema. When this console remains accessible in production environments, it exposes sensitive database information and functionality to unauthorized users.

Remediation

Ensure the Grails application runs in production mode rather than development mode when deployed to production environments. Production mode automatically disables the database console and other development-only features.

To configure production mode, set the appropriate environment when starting the application:

grails prod run-app

Or when deploying as a WAR file, ensure the application server is configured to use the production environment:

grails.env=production

Additionally, verify that the /dbconsole/ endpoint returns a 404 error in production by testing the URL after deployment. If you need database administration capabilities in production, implement a separate, properly secured administrative interface with strong authentication and authorization controls, and restrict access by IP address or VPN.