{"id":102176,"date":"2021-11-02T03:36:46","date_gmt":"2021-11-02T01:36:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster"},"modified":"2021-11-02T03:36:46","modified_gmt":"2021-11-02T01:36:46","slug":"uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster","title":{"rendered":"Zranitelnost umo\u017e\u0148uj\u00edc\u00ed vkl\u00e1d\u00e1n\u00ed JavaScriptov\u00e9ho k\u00f3du p\u0159es WordPress plugin OptinMonster","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ve WordPress pluginu OptinMonster, kter\u00fd m\u00e1 v\u00edce ne\u017e milion aktivn\u00edch instalac\u00ed a slou\u017e\u00ed k zobrazov\u00e1n\u00ed vyskakovac\u00edch upozorn\u011bn\u00ed a nab\u00eddek, byla zji\u0161t\u011bna zranitelnost (CVE-2021-39341), kter\u00e1 umo\u017e\u0148uje vlo\u017een\u00ed vlastn\u00edho JavaScriptov\u00e9ho k\u00f3du na webu pou\u017e\u00edvaj\u00edc\u00edm tento plugin. Zranitelnost byla odstran\u011bna ve verzi 2.6.5. Aby se zablokoval p\u0159\u00edstup prost\u0159ednictv\u00edm ukraden\u00fdch kl\u00ed\u010d\u016f po instalaci aktualizace, v\u00fdvoj\u00e1\u0159i OptinMonster zneplatnili v\u0161echny d\u0159\u00edve vytvo\u0159en\u00e9 kl\u00ed\u010de API a p\u0159idali omezen\u00ed pro pou\u017e\u00edv\u00e1n\u00ed kl\u00ed\u010d\u016f WordPressov\u00fdch web\u016f pro zm\u011bnu kampan\u00ed OptinMonster. <\/p>\n

Probl\u00e9m je zp\u016fsoben existenc\u00ed REST-API \/wp-json\/omapp\/v1\/support, k n\u011bmu\u017e bylo mo\u017en\u00e9 p\u0159istupovat bez autentizace \u2014 dotaz byl prov\u00e1d\u011bn bez dal\u0161\u00edch ov\u011b\u0159en\u00ed, pokud byla v hlavi\u010dce Referer uvedena \u0159et\u011bzec \u201ehttps:\/\/wp.app.optinmonster.test\u201c a p\u0159i nastaven\u00ed typu HTTP po\u017eadavku na \u201eOPTIONS\u201c (p\u0159episov\u00e1no pomoc\u00ed HTTP hlavi\u010dky \u201eX-HTTP-Method-Override\u201c). Mezi daty vracen\u00fdmi p\u0159i dotazu na uveden\u00e9 REST-API byl kl\u00ed\u010d p\u0159\u00edstupu, kter\u00fd umo\u017e\u0148uje pos\u00edlat dotazy na jak\u00e9koli zpracovatele REST-API. <\/p>\n

Pomoc\u00ed z\u00edskan\u00e9ho kl\u00ed\u010de mohl \u00fato\u010dn\u00edk prov\u00e9st zm\u011bny v jak\u00fdchkoli vyskakovac\u00edch oknech zobrazen\u00fdch pomoc\u00ed OptinMonster, v\u010detn\u011b spu\u0161t\u011bn\u00ed sv\u00e9ho JavaScriptov\u00e9ho k\u00f3du. Z\u00edsk\u00e1n\u00edm mo\u017enosti prov\u00e9st sv\u016fj JavaScriptov\u00fd k\u00f3d v kontextu webu mohl \u00fato\u010dn\u00edk p\u0159esm\u011brovat u\u017eivatele na sv\u016fj web nebo prov\u00e9st substituci privilegovan\u00fdch \u00fa\u010dt\u016f v webov\u00e9m rozhran\u00ed p\u0159i prov\u00e1d\u011bn\u00ed vlo\u017een\u00e9ho JavaScriptov\u00e9ho k\u00f3du administr\u00e1torem webu. S p\u0159\u00edstupem do webov\u00e9ho rozhran\u00ed mohl \u00fato\u010dn\u00edk dos\u00e1hnout proveden\u00ed sv\u00e9ho PHP k\u00f3du na serveru<\/a>.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 OptinMonster, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u0432\u043e\u0434\u0430 \u0432\u0441\u043f\u043b\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-39341), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 JavaScript-\u043a\u043e\u0434 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 2.6.5. \u0414\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d\u043d\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 OptinMonster \u0430\u043d\u043d\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u0441\u0435 \u0440\u0430\u043d\u0435\u0435 \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102176","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranitelnost, kter\u00e1 umo\u017e\u0148uje vlo\u017een\u00ed JavaScriptov\u00e9ho k\u00f3du prost\u0159ednictv\u00edm WordPress pluginu OptinMonster | ProHoster","description":"Ve WordPress pluginu OptinMonster, kter\u00fd m\u00e1 v\u00edce ne\u017e milion aktivn\u00edch instalac\u00ed a slou\u017e\u00ed k zobrazov\u00e1n\u00ed vyskakovac\u00edch upozorn\u011bn\u00ed a nab\u00eddek, byla zji\u0161t\u011bna zranitelnost (CVE-2021-39341), kter\u00e1 umo\u017e\u0148uje vlo\u017een\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 JavaScript-\u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d OptinMonster | ProHoster","og:description":"\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 OptinMonster, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u0432\u043e\u0434\u0430 \u0432\u0441\u043f\u043b\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-39341), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-02T01:36:46+00:00","article:modified_time":"2021-11-02T01:36:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102176","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-02 01:36:50","updated":"2026-02-09 21:39:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102176","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=102176"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102176\/revisions"}],"predecessor-version":[{"id":159966,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/102176\/revisions\/159966"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=102176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=102176"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=102176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}