# Gradle Wrapper Attack Report

DevFeed: [Gradle Wrapper Attack Report](<https://devfeed.tech/articles/gradle-wrapper-attack-report-24708.md>)

Original publisher: [Read original article](<https://blog.gradle.org/wrapper-attack-report>)

Author: Louis Jacomet

Published: 2023-01-25T05:00:00Z

Content type: article

Language: en

Sources: [The Gradle Blog](<https://devfeed.tech/sources/the-gradle-blog.md>)

Topics: [Gradle](<https://devfeed.tech/topics/gradle.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Discord](<https://devfeed.tech/topics/discord.md>), [Regular expression](<https://devfeed.tech/topics/regular-expression.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [blog](<https://devfeed.tech/tags/blog.md>), [code](<https://devfeed.tech/tags/code.md>), [dependency](<https://devfeed.tech/tags/dependency.md>), [developer](<https://devfeed.tech/tags/developer.md>), [discord](<https://devfeed.tech/tags/discord.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [exploits](<https://devfeed.tech/tags/exploits.md>), [expression](<https://devfeed.tech/tags/expression.md>), [gradle](<https://devfeed.tech/tags/gradle.md>), [report](<https://devfeed.tech/tags/report.md>), [third-party](<https://devfeed.tech/tags/third-party.md>)

## AI overview

This report analyzes two suspicious Gradle Wrapper JARs found in MinecraftOnline repositories. The JARs contained exploits that attempted to steal Discord credentials and, in one case, download and execute another malicious JAR that modified a project to inject malicious code and dependencies.

## Source excerpt

On January 11th 2023, we were contacted by MinecraftOnline about two unusual and suspicious Gradle wrapper JARs found in some of their repositories. The wrappers were updated by a new contributor to MinecraftOnline. We've performed an analysis of the JARs and will describe our findings below. We have determined that one exploit was especially crafted as an attack against the MinecraftOnline project. If you are not interested in all of the details, jump immediately to our companion blog covering how to protect your project or you, as a developer, against similar attacks. Analysis Our analysis started by confirming that the SHA256 checksums for both JARs did not match any of the known good Gradle Wrapper checksums: First JAR: 8449b6955690ec956c8ecfe1ae01e10a2aa76ddf18969985c070e345605acce1 Second JAR: 8e129181710bdc045423ddde59244586d7acbc0b2c5e2ddfc098559da559cf85 After decompiling the two JARs, we discovered two exploits had been patched into the wrapper JAR. Discord credentials stealing The first exploit, present in both JARs, attempts to steal Discord credentials by looking into specific files on the host computer. The code is very similar to Discord token logging found online. The exploit hides in different Gradle Wrapper classes and obfuscates String constants through a character array lookup. Using a regular expression, lines from certain files are uploaded to a Discord Webhook using a hardcoded token found in the code. Downloading and running code locally The second JAR contains an additional exploit. On certain Gradle invocations, it will attempt to download another malicious JAR and then run it. For this code path to trigger, the Gradle invocation needed to start with publish or magic. publish is a Gradle task for pushing all project artifacts to a repository. Builds that publish artifacts typically have access to higher privileged credentials. We think that magic was used as a way to test the exploit. Running that JAR resulted in the following actions: Edit