{"id":156092,"date":"2026-02-01T11:11:55","date_gmt":"2026-02-01T09:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone"},"modified":"2026-02-01T11:11:55","modified_gmt":"2026-02-01T09:11:55","slug":"atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","title":{"rendered":"\u00dato\u010dn\u00edk\u016fm se poda\u0159ilo p\u0159idat nepozorovan\u00fd \u0161kodliv\u00fd k\u00f3d do repozit\u00e1\u0159e Plone","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1\u0159i open-source syst\u00e9mu pro spr\u00e1vu obsahu Plone, napsan\u00e9ho v Pythonu a JavaScriptu\/NodeJS, ozn\u00e1mili incident, p\u0159i kter\u00e9m byl do git repozit\u00e1\u0159e projektu na GitHubu p\u0159id\u00e1n \u0161kodliv\u00fd k\u00f3d. P\u016fvodn\u011b byly v repozit\u00e1\u0159i identifikov\u00e1ny t\u0159i \u00fapravy z 7. ledna (1, 2, 3), kter\u00e9 do projektov\u00fdch JavaScriptov\u00fdch soubor\u016f p\u0159id\u00e1valy \u0161kodliv\u00fd k\u00f3d (1, 2, 3). Analyza incidentu uk\u00e1zala, \u017ee integrace \u0161kodliv\u00e9ho k\u00f3du byla provedena v d\u016fsledku kompromitace \u00fa\u010dtu jednoho z v\u00fdvoj\u00e1\u0159\u016f, jeho\u017e p\u0159\u00edstupov\u00fd token byl zachycen \u00fato\u010dn\u00edky po spu\u0161t\u011bn\u00ed \u0161kodliv\u00e9ho softwaru v jeho syst\u00e9mu. <\/p>\n

Dne 14. ledna byl kompromitovan\u00fd \u00fa\u010det zablokov\u00e1n a v\u00fdvoj\u00e1\u0159\u016fm projektu bylo doporu\u010deno analyzovat commity od 1. do 14. ledna. Dne 27. ledna bylo zji\u0161t\u011bno, \u017ee zm\u00edn\u011bn\u00fdmi commity incident nekon\u010dil a \u00fatok zas\u00e1hl p\u011bt repozit\u00e1\u0159\u016f projektu (plone\/volto, plone\/mockup, plone\/plone.app.mosaic, plone\/critical-css-cli, plone\/plonetheme.barceloneta), do nich\u017e byl nen\u00e1padn\u011b integrov\u00e1n \u0161kodliv\u00fd k\u00f3d. V p\u0159\u00edpad\u011b repozit\u00e1\u0159e plone.app.mosaic se \u00fato\u010dn\u00edk\u016fm poda\u0159ilo podvrhnout master v\u011btev. \u00datok byl proveden dva m\u011bs\u00edce po zachycen\u00ed p\u0159\u00edstupov\u00e9ho tokenu v\u00fdvoj\u00e1\u0159e. <\/p>\n

Pro integraci zm\u011bn \u00fato\u010dn\u00edci m\u00edsto b\u011b\u017en\u00fdch commit\u016f vyu\u017eili operaci \u201eforce push\u201c (git push s volbou \u201e\u2014force\u201c), kter\u00e1 umo\u017e\u0148uje n\u00e1siln\u011b nahradit v\u011btev ve vzd\u00e1len\u00e9m \u00falo\u017ei\u0161ti jej\u00edm obsahem a t\u00edm p\u00e1dem p\u0159epsat historii zm\u011bn (po nahrazen\u00ed se zobraz\u00ed historie z v\u011btve nahran\u00e9 \u00fato\u010dn\u00edkem). Aby se p\u0159ede\u0161lo takov\u00fdmto podvod\u016fm v budoucnosti, v\u00fdvoj\u00e1\u0159i Plone v\u010detn\u011b pravidel v GitHubu zablokovali operace \u201eforce push\u201c pro hlavn\u00ed v\u011btve a tagy. <\/p>\n

V repozit\u00e1\u0159i plone.app.mosaic, aby zt\u00ed\u017eili odhalen\u00ed kompromitace, \u00fato\u010dn\u00edci vlo\u017eili do master-v\u011btve \u0161kodliv\u00fd commit s fiktivn\u00edm datem \u2014 18. prosince, s domn\u011bnkou, \u017ee oblast vyhled\u00e1v\u00e1n\u00ed \u0161kodliv\u00e9ho k\u00f3du se zam\u011b\u0159\u00ed na zm\u011bny p\u0159idan\u00e9 po jejich prvn\u00ed aktivit\u011b v repozit\u00e1\u0159i. \u0160kodliv\u00e1 zm\u011bna byla p\u0159edkl\u00e1d\u00e1na ve vlo\u017een\u00e9m commitu jako za\u010d\u00e1tek v\u00fdvoje nov\u00e9 testovac\u00ed verze, ale krom\u011b zm\u011bny \u010d\u00edsla verze v metadatech (ze 4.0.0a1 na 4.0.0a2.dev0) byl do volan\u00e9ho javascriptov\u00e9ho souboru b\u011bhem f\u00e1ze sestaven\u00ed prettier.config.js p\u0159id\u00e1n \u0161kodliv\u00fd k\u00f3d. Aby se skr\u00fdval p\u0159i pohledu na zm\u011bny v termin\u00e1lu, byl k\u00f3d p\u0159id\u00e1n v jedn\u00e9 \u0159ad\u011b s legitimn\u00ed operac\u00ed a posunut z viditeln\u00e9 oblasti pomoc\u00ed mezer. V rozhran\u00ed GitHub tento k\u00f3d tak\u00e9 nebyl ve v\u00fdchoz\u00edm nastaven\u00ed vid\u011bt a vy\u017eadoval stisknut\u00ed tla\u010d\u00edtka \u201eNa\u010d\u00edst Diff\u201c.

\"\u00dato\u010dn\u00edk\u016fm<\/center> <\/p>\n

\u00datok byl v\u00edce zam\u011b\u0159en na v\u00fdvoj\u00e1\u0159e projektu ne\u017e na u\u017eivatele. \u0160kodliv\u00e9 zm\u011bny nebyly zahrnuty do vyd\u00e1n\u00ed. \u0160kodliv\u00fd k\u00f3d se aktivoval b\u011bhem sestaven\u00ed, stahoval exploit pro pov\u00fd\u0161en\u00ed opr\u00e1vn\u011bn\u00ed, nastavoval automatick\u00e9 spou\u0161t\u011bn\u00ed prost\u0159ednictv\u00edm vol\u00e1n\u00ed vlastn\u00edch proces\u016f ze startovac\u00edch skript\u016f a umo\u017e\u0148oval vzd\u00e1len\u00e9 ovl\u00e1d\u00e1n\u00ed. serverem<\/a>Krom\u011b toho instalovan\u00fd \u0161kodliv\u00fd komponent prov\u00e1d\u011bl vyhled\u00e1v\u00e1n\u00ed a odes\u00edl\u00e1n\u00ed citliv\u00fdch \u00fadaj\u016f, jako jsou p\u0159\u00edstupov\u00e9 tokeny, profily prohl\u00ed\u017ee\u010d\u016f a kl\u00ed\u010de od kryptopen\u011b\u017eenek.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Plone, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Python \u0438 JavaScript\/NodeJS, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 GitHub \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0438\u0445\u0441\u044f 7 \u044f\u043d\u0432\u0430\u0440\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f (1, 2, 3), \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 JavaScript-\u0444\u0430\u0439\u043b\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 (1, 2, 3). \u0420\u0430\u0437\u0431\u043e\u0440 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":156093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-156092","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00dato\u010dn\u00edk\u016fm se poda\u0159ilo p\u0159idat nen\u00e1padn\u00fd \u0161kodliv\u00fd k\u00f3d do repozit\u00e1\u0159e Plone | ProHoster","description":"V\u00fdvoj\u00e1\u0159i svobodn\u00e9ho syst\u00e9mu pro spr\u00e1vu obsahu Plone, napsan\u00e9ho v Pythonu a JavaScriptu\/NodeJS, ozn\u00e1mili incident, p\u0159i kter\u00e9m byl do git repozit\u00e1\u0159e projektu na GitHubu p\u0159id\u00e1n \u0161kodliv\u00fd k\u00f3d.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Plone | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Plone, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Python \u0438 JavaScript\/NodeJS, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 GitHub \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-02-01T09:11:55+00:00","article:modified_time":"2026-02-01T09:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"156092","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:49:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-01 09:11:56","updated":"2026-02-09 21:49:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/156092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=156092"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/156092\/revisions"}],"predecessor-version":[{"id":160399,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/156092\/revisions\/160399"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/156093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=156092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=156092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=156092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}