{"id":105307,"date":"2022-10-14T15:36:38","date_gmt":"2022-10-14T13:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah"},"modified":"2022-10-14T15:36:38","modified_gmt":"2022-10-14T13:36:38","slug":"ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah","title":{"rendered":"\u00datok na NPM, kter\u00fd umo\u017e\u0148uje zjistit p\u0159\u00edtomnost bal\u00ed\u010dk\u016f v soukrom\u00fdch repozit\u00e1\u0159\u00edch","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V NPM byla odhalena nedokonalost, kter\u00e1 umo\u017e\u0148uje zjistit existenci bal\u00ed\u010dk\u016f v uzav\u0159en\u00fdch repozit\u00e1\u0159\u00edch. Probl\u00e9m je zp\u016fsoben r\u016fzn\u00fdm \u010dasem odezvy p\u0159i dotazu na existuj\u00edc\u00ed a neexistuj\u00edc\u00ed bal\u00ed\u010dek ze strany u\u017eivatele, kter\u00fd nem\u00e1 p\u0159\u00edstup k repozit\u00e1\u0159i. P\u0159i nedostatku p\u0159\u00edstupu pro jak\u00e9koli bal\u00ed\u010dky v soukrom\u00fdch repozit\u00e1\u0159\u00edch server registry.npmjs.org vrac\u00ed chybu s k\u00f3dem \u201e404\u201c, ale v p\u0159\u00edpad\u011b existence bal\u00ed\u010dku se po\u017eadovan\u00fdm jm\u00e9nem se chyba zobraz\u00ed s v\u00fdrazn\u00fdm zpo\u017ed\u011bn\u00edm. \u00dato\u010dn\u00edk m\u016f\u017ee tuto vlastnost vyu\u017e\u00edt k ur\u010den\u00ed p\u0159\u00edtomnosti bal\u00ed\u010dku p\u0159i pokusu o odhadov\u00e1n\u00ed n\u00e1zv\u016f bal\u00ed\u010dk\u016f pomoc\u00ed slovn\u00edk\u016f. <\/p>\n

Zji\u0161t\u011bn\u00ed n\u00e1zv\u016f bal\u00ed\u010dk\u016f v uzav\u0159en\u00fdch repozit\u00e1\u0159\u00edch m\u016f\u017ee b\u00fdt pot\u0159ebn\u00e9 k proveden\u00ed \u00fatoku prost\u0159ednictv\u00edm sm\u00ed\u0161en\u00ed z\u00e1vislost\u00ed, manipuluj\u00edc\u00edho s p\u0159ekryvy n\u00e1zv\u016f z\u00e1vislost\u00ed v ve\u0159ejn\u00fdch a intern\u00edch repozit\u00e1\u0159\u00edch. Znalost\u00ed, kter\u00e9 intern\u00ed NPM bal\u00ed\u010dky jsou p\u0159\u00edtomny v korpor\u00e1tn\u00edch repozit\u00e1\u0159\u00edch, m\u016f\u017ee \u00fato\u010dn\u00edk um\u00edstit bal\u00ed\u010dky se stejn\u00fdmi n\u00e1zvy a nov\u011bj\u0161\u00edmi verzemi do ve\u0159ejn\u00e9ho repozit\u00e1\u0159e NPM. Pokud nejsou p\u0159i sestaven\u00ed intern\u00ed knihovny v\u00fdslovn\u011b v\u00e1z\u00e1ny v nastaven\u00ed na sv\u016fj repozit\u00e1\u0159, bal\u00ed\u010dkov\u00fd spr\u00e1vce npm pova\u017euje ve\u0159ejn\u00fd repozit\u00e1\u0159 za prioritn\u00ed a st\u00e1hne p\u0159ipraven\u00fd bal\u00ed\u010dek od \u00fato\u010dn\u00edka. <\/p>\n

GitHub byl na probl\u00e9m upozorn\u011bn v b\u0159eznu, ale odm\u00edtl p\u0159idat ochranu proti \u00fatoku, odvol\u00e1vaj\u00edc\u00ed se na architektonick\u00e1 omezen\u00ed. Firm\u00e1m pou\u017e\u00edvaj\u00edc\u00edm soukrom\u00e9 repozit\u00e1\u0159e se doporu\u010duje pravideln\u011b kontrolovat v\u00fdskyt p\u0159ekr\u00fdvaj\u00edc\u00edch se n\u00e1zv\u016f ve ve\u0159ejn\u00e9m repozit\u00e1\u0159i nebo vytvo\u0159it pod sv\u00fdm jm\u00e9nem z\u00e1stupce se jm\u00e9ny, kter\u00e9 se shoduj\u00ed s n\u00e1zvy bal\u00ed\u010dk\u016f v soukrom\u00fdch repozit\u00e1\u0159\u00edch, aby \u00fato\u010dn\u00edci nemohli um\u00edstit sv\u00e9 bal\u00ed\u010dky se shoduj\u00edc\u00edmi se n\u00e1zvy.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043d\u0435\u0434\u043e\u0440\u0430\u0431\u043e\u0442\u043a\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0440\u0430\u0437\u043d\u044b\u043c \u0432\u0440\u0435\u043c\u0435\u043d\u0435\u043c \u0440\u0435\u0430\u043a\u0446\u0438\u0438 \u043f\u0440\u0438 \u0437\u0430\u043f\u0440\u043e\u0441\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u0438 \u043d\u0435\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c, \u043d\u0435 \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044e. \u041f\u0440\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0434\u043b\u044f \u043b\u044e\u0431\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 \u0441\u0435\u0440\u0432\u0435\u0440 registry.npmjs.org \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043e\u0448\u0438\u0431\u043a\u0443 \u0441 \u043a\u043e\u0434\u043e\u043c «404», \u043d\u043e \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u0430 \u0441 \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u043c \u0438\u043c\u0435\u043d\u0435\u043c \u043e\u0448\u0438\u0431\u043a\u0430 \u0432\u044b\u0434\u0430\u0451\u0442\u0441\u044f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105307","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00datok na NPM, kter\u00fd umo\u017e\u0148uje zjistit p\u0159\u00edtomnost bal\u00ed\u010dk\u016f v soukrom\u00fdch repozit\u00e1\u0159\u00edch | ProHoster","description":"V NPM byla odhalena nedostate\u010dnost, kter\u00e1 umo\u017e\u0148uje zjistit existenci bal\u00ed\u010dk\u016f v uzav\u0159en\u00fdch repozit\u00e1\u0159\u00edch.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 NPM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u043f\u0440\u0438\u0432\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445 | ProHoster","og:description":"\u0412 NPM \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043d\u0435\u0434\u043e\u0440\u0430\u0431\u043e\u0442\u043a\u0430, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f\u0445.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/ataka-na-npm-pozvolyayushhaya-opredelit-nalichie-paketov-v-privatnyh-repozitoriyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-10-14T13:36:38+00:00","article:modified_time":"2022-10-14T13:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/105307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=105307"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/105307\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=105307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=105307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=105307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}