| Titre | FlowCI flow-core-x v1.23.01 remote code execution |
|---|
| Description | flow-ci evaluates step-level `condition` fields from `.flowci.yml` pipeline configurations using GroovyShell without any sandbox restrictions. `ConditionManagerImpl.run()` creates a `new GroovyShell(binding)` and calls `groovy.evaluate(groovyScript)` directly — there is no `SecureASTCustomizer`, no `CompilerConfiguration` whitelist, and no `SecurityManager` fallback. The script content is entirely user-controlled through the step-level `condition` field.
The condition is evaluated in the **flow-ci core container**, inside the `flowci-core.jar` JVM process. It is not evaluated in an agent container or in a temporary job container created for a pipeline step. In `JobActionServiceImpl.executeJob()`, `runCondition()` is called before the code attempts to locate an agent, dispatch the bash step, or set the step to `WAITING_AGENT`. A condition-only browser PoC therefore succeeds even when no agent is online.
Runtime verification confirms that the executing process has PID 1, the command line `java ... -jar flowci-core.jar`, working directory `/flow.ci`, and the core container hostname. This proves that Groovy code executes in the same root process that serves the flow-ci core API, not in a job/agent environment where arbitrary commands might already be expected. |
|---|
| La source | ⚠️ https://glacier-tarsal-711.notion.site/Flow-ci-Unrestricted-GroovyShell-Remote-Code-Execution-in-flow-ci-CI-Condition-Evaluation-3f7b25e24b368091a9c8d7bbf28fa5bd |
|---|
| Utilisateur | Zy0t1 (UID 100983) |
|---|
| Soumission | 13/10/2026 10:24 (il y a 25 jours) |
|---|
| Modérer | 07/11/2026 20:35 (25 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 432648 [FlowCI flow-core-x jusqu’à 1.23.49 Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run condition élévation de privilèges] |
|---|
| Points | 17 |
|---|