| 标题 | FlowCI flow-core-x v1.23.01 remote code execution |
|---|
| 描述 | flow-ci evaluates step-level `condition` fields from `.flowci.yml` pipeline configurations using GroovyShell without any sandbox restrictions. `ConditionManagerImpl.run()` creates a `new GroovyShell(binding)` and calls `groovy.evaluate(groovyScript)` directly — there is no `SecureASTCustomizer`, no `CompilerConfiguration` whitelist, and no `SecurityManager` fallback. The script content is entirely user-controlled through the step-level `condition` field.
The condition is evaluated in the **flow-ci core container**, inside the `flowci-core.jar` JVM process. It is not evaluated in an agent container or in a temporary job container created for a pipeline step. In `JobActionServiceImpl.executeJob()`, `runCondition()` is called before the code attempts to locate an agent, dispatch the bash step, or set the step to `WAITING_AGENT`. A condition-only browser PoC therefore succeeds even when no agent is online.
Runtime verification confirms that the executing process has PID 1, the command line `java ... -jar flowci-core.jar`, working directory `/flow.ci`, and the core container hostname. This proves that Groovy code executes in the same root process that serves the flow-ci core API, not in a job/agent environment where arbitrary commands might already be expected. |
|---|
| 来源 | ⚠️ https://glacier-tarsal-711.notion.site/Flow-ci-Unrestricted-GroovyShell-Remote-Code-Execution-in-flow-ci-CI-Condition-Evaluation-3f7b25e24b368091a9c8d7bbf28fa5bd |
|---|
| 用户 | Zy0t1 (UID 100983) |
|---|
| 提交 | 2026-10-13 10時24分 (26 日前) |
|---|
| 管理 | 2026-11-07 20時35分 (25 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 432648 [FlowCI flow-core-x 直到 1.23.49 Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run condition 权限提升] |
|---|
| 积分 | 17 |
|---|