| 제목 | FlowCI flow-core-x v1.23.01 remote code execution |
|---|
| 설명 | flow-ci evaluates step-level `condition` fields from `.flowci.yml` pipeline configurations using GroovyShell without any sandbox restrictions. `ConditionManagerImpl.run()` creates a `new GroovyShell(binding)` and calls `groovy.evaluate(groovyScript)` directly — there is no `SecureASTCustomizer`, no `CompilerConfiguration` whitelist, and no `SecurityManager` fallback. The script content is entirely user-controlled through the step-level `condition` field.
The condition is evaluated in the **flow-ci core container**, inside the `flowci-core.jar` JVM process. It is not evaluated in an agent container or in a temporary job container created for a pipeline step. In `JobActionServiceImpl.executeJob()`, `runCondition()` is called before the code attempts to locate an agent, dispatch the bash step, or set the step to `WAITING_AGENT`. A condition-only browser PoC therefore succeeds even when no agent is online.
Runtime verification confirms that the executing process has PID 1, the command line `java ... -jar flowci-core.jar`, working directory `/flow.ci`, and the core container hostname. This proves that Groovy code executes in the same root process that serves the flow-ci core API, not in a job/agent environment where arbitrary commands might already be expected. |
|---|
| 원천 | ⚠️ https://glacier-tarsal-711.notion.site/Flow-ci-Unrestricted-GroovyShell-Remote-Code-Execution-in-flow-ci-CI-Condition-Evaluation-3f7b25e24b368091a9c8d7bbf28fa5bd |
|---|
| 사용자 | Zy0t1 (UID 100983) |
|---|
| 제출 | 2026. 10. 13. AM 10:24 (26 날 ago) |
|---|
| 모더레이션 | 2026. 11. 07. PM 08:35 (25 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 432648 [FlowCI flow-core-x 까지 1.23.49 Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run condition 권한 상승] |
|---|
| 포인트들 | 17 |
|---|