{"id":100784,"date":"2021-07-17T22:22:35","date_gmt":"2021-07-17T20:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare"},"modified":"2021-07-17T22:22:35","modified_gmt":"2021-07-17T20:22:35","slug":"uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","title":{"rendered":"Zranitelnost v cdnjs umo\u017e\u0148uj\u00edc\u00ed vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du na serverech Cloudflare.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V s\u00edti pro doru\u010dov\u00e1n\u00ed obsahu cdnjs, kterou poskytuje spole\u010dnost Cloudflare a kter\u00e1 je ur\u010dena ke zrychlen\u00ed doru\u010den\u00ed knihoven JavaScript, byla zji\u0161t\u011bna kritick\u00e1 zranitelnost, kter\u00e1 umo\u017e\u0148uje prov\u00e1d\u011bt libovoln\u00fd k\u00f3d na serverech CDN. Nebezpe\u010d\u00ed t\u00e9to situace je umocn\u011bno t\u00edm, \u017ee pro na\u010d\u00edt\u00e1n\u00ed knihoven JavaScript vyu\u017e\u00edv\u00e1 slu\u017ebu p\u0159ibli\u017en\u011b 12,7 % v\u0161ech webov\u00fdch str\u00e1nek na internetu, a kompromitace infrastruktury umo\u017e\u0148uje zam\u011bn\u011bn\u00ed knihoven, kter\u00e9 jsou poskytov\u00e1ny jakoukoli z t\u011bchto str\u00e1nek. <\/p>\n

Slu\u017eba cdnjs na\u010d\u00edt\u00e1 bal\u00ed\u010dky z Gitu nebo repozit\u00e1\u0159e NPM a pot\u00e9 d\u00e1v\u00e1 mo\u017enost jak\u00e9mukoli webu zdarma vyu\u017e\u00edvat s\u00ed\u0165 Cloudflare pro zrychlen\u00ed na\u010d\u00edt\u00e1n\u00ed knihoven JavaScript. P\u0159i zkoum\u00e1n\u00ed k\u00f3du komponent\u016f cdnjs, publikovan\u00fdch na GitHubu, bylo zji\u0161t\u011bno, \u017ee pro rozbalen\u00ed bal\u00ed\u010dk\u016f NPM v archivech tgz se pou\u017e\u00edv\u00e1 standardn\u00ed modul archive\/tar napsan\u00fd v Go, kter\u00fd vrac\u00ed seznam soubor\u016f tak, jak jsou, bez normalizace cest. V p\u0159\u00edpad\u011b, \u017ee skript rozbal\u00ed obsah na z\u00e1klad\u011b uveden\u00e9ho seznamu, p\u0159\u00edtomnost soubor\u016f ve form\u00e1tu \u201e.. \/.. \/.. \/.. \/.. \/.. \/.. \/tmp \/test\u201c v archivu m\u016f\u017ee v\u00e9st k p\u0159eps\u00e1n\u00ed libovoln\u00fdch soubor\u016f v syst\u00e9mu, co\u017e umo\u017e\u0148uj\u00ed p\u0159\u00edstupov\u00e1 pr\u00e1va. <\/p>\n

Bylo p\u0159edpokl\u00e1d\u00e1no, \u017ee \u00fato\u010dn\u00edk m\u016f\u017ee po\u017e\u00e1dat o p\u0159id\u00e1n\u00ed sv\u00e9 knihovny do cdnjs a nahr\u00e1t do repozit\u00e1\u0159e NPM speci\u00e1ln\u011b p\u0159ipraven\u00fd archiv obsahuj\u00edc\u00ed soubory se symboly \u201e.. \/\u201c v cest\u011b. Na serverech cdnjs se pravideln\u011b prov\u00e1d\u00ed operace \u201eautoupdate\u201c, b\u011bhem n\u00ed\u017e zpracovatel na\u010d\u00edt\u00e1 nov\u00e9 verze navr\u017een\u00e9 knihovny a rozbal\u00ed obsah. Pomoc\u00ed soubor\u016f s cestami \u201e.. \/\u201c m\u016f\u017ee \u00fato\u010dn\u00edk dos\u00e1hnout p\u0159eps\u00e1n\u00ed soubor\u016f se skripty slu\u017eby a spu\u0161t\u011bn\u00ed vlastn\u00edho k\u00f3du na serveru<\/a> na kter\u00e9m prob\u00edhalo rozbalov\u00e1n\u00ed. <\/p>\n

P\u0159i na\u010d\u00edt\u00e1n\u00ed aktualizac\u00ed z Git bylo zji\u0161t\u011bno, \u017ee zpracovatel na\u010d\u00edt\u00e1n\u00ed aktualizac\u00ed nezohled\u0148oval symbolick\u00e9 odkazy p\u0159i kop\u00edrov\u00e1n\u00ed soubor\u016f z Git. Tato vlastnost umo\u017enila organizovat \u010dten\u00ed jak\u00fdchkoli soubor\u016f s serveru<\/a> p\u0159id\u00e1n\u00edm symbolick\u00fdch odkaz\u016f do Git. <\/p>\n

Experimenty s demonstra\u010dn\u00edm hackov\u00e1n\u00edm cdnjs za \u00fa\u010delem z\u00edsk\u00e1n\u00ed odm\u011bny na HackerOne za\u010daly ov\u011b\u0159en\u00edm hypot\u00e9zy o \u010dten\u00ed soubor\u016f. Do Git repozit\u00e1\u0159e poskytovan\u00e9ho prost\u0159ednictv\u00edm CDN JavaScript knihovny byla p\u0159id\u00e1na symbolick\u00e1 linka test.js, kter\u00e1 ukazovala na soubor \/proc\/self\/maps. Po zve\u0159ejn\u011bn\u00ed nov\u00e9 verze knihovny zpracoval aktualiza\u010dn\u00ed skript tento repozit\u00e1\u0159 a zve\u0159ejnil dan\u00fd soubor v cdnjs (test.js byla vytvo\u0159ena jako symbolick\u00e1 linka a p\u0159i po\u017eadavku na tento soubor byl vr\u00e1cen obsah \/proc\/self\/maps). <\/p>\n

Vlo\u017een\u00edm symbolick\u00e9 linky na soubor \/proc\/self\/environ autor studie poznamenal, \u017ee uvnit\u0159 vr\u00e1cen\u00fdch dat jsou hodnoty prom\u011bnn\u00fdch prost\u0159ed\u00ed GITHUB_REPO_API_KEY a WORKERS_KV_API_TOKEN. V prvn\u00ed prom\u011bnn\u00e9 se nach\u00e1zel kl\u00ed\u010d k API pro p\u0159\u00edstup s opr\u00e1vn\u011bn\u00edm k z\u00e1pisu do repozit\u00e1\u0159e robocdnjs na GitHubu. Ve druh\u00e9 prom\u011bnn\u00e9 byl ulo\u017een token pro KV \u00falo\u017ei\u0161t\u011b v cdnjs. Vyu\u017eit\u00edm t\u011bchto informac\u00ed mohl \u00fato\u010dn\u00edk prov\u00e9st zm\u011bny v cdnjs a zcela zkompromitovat infrastrukturu.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cloudflare \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 cdnjs, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0439 \u0434\u043b\u044f \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 CDN. \u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0443\u0433\u0443\u0431\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u043c, \u0447\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c \u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043e\u043a\u043e\u043b\u043e 12.7% \u0432\u0441\u0435\u0445 \u0441\u0430\u0439\u0442\u043e\u0432 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u043e\u0442\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u043b\u044e\u0431\u044b\u043c \u0438\u0437 \u044d\u0442\u0438\u0445 \u0441\u0430\u0439\u0442\u043e\u0432. \u0421\u0435\u0440\u0432\u0438\u0441 cdnjs \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100784","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost v cdnjs, kter\u00e1 umo\u017enila vykon\u00e1vat k\u00f3d na serverech Cloudflare | ProHoster","description":"V poskytovan\u00e9 spole\u010dnosti Cloudflare s\u00edti pro doru\u010dov\u00e1n\u00ed obsahu cdnjs, ur\u010den\u00e9 k urychlen\u00ed doru\u010dov\u00e1n\u00ed JavaScript knihoven, byla zji\u0161t\u011bna kritick\u00e1 zranitelnost, kter\u00e1 umo\u017e\u0148uje prov\u00e1d\u011bt libovoln\u00fd k\u00f3d na serverech.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 cdnjs, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Cloudflare | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cloudflare \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 cdnjs, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0439 \u0434\u043b\u044f \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-17T20:22:35+00:00","article:modified_time":"2021-07-17T20:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100784","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-17 22:01:30","updated":"2026-02-22 15:30:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/100784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=100784"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/100784\/revisions"}],"predecessor-version":[{"id":162261,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/100784\/revisions\/162261"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=100784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=100784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=100784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}