{"id":183985,"date":"2026-10-24T23:40:31","date_gmt":"2026-10-24T21:40:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/kriticheskaya-uyazvimost-v-dekodirovshhike-brotli-zatragivayushhaya-node-js-bun-brauzery-http-klienty-i-drugie-proekty"},"modified":"2026-10-24T23:40:36","modified_gmt":"2026-10-24T21:40:36","slug":"critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects","title":{"rendered":"Kritick\u00e1 zranitelnost v dekompresoru Brotli, kter\u00e1 se dot\u00fdk\u00e1 Node.JS, Bun, prohl\u00ed\u017ee\u010d\u016f, HTTP klient\u016f a dal\u0161\u00edch projekt\u016f","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
V referen\u010dn\u00ed knihovn\u011b s implementac\u00ed dekod\u00e9ru form\u00e1tu komprese dat Brotli byla zji\u0161t\u011bna zranitelnost (CVE-2026-111497, k\u00f3dov\u00e1 jm\u00e9na Broccoli2Shell a HTTP2Shell), vedouc\u00ed k p\u0159ete\u010den\u00ed vyrovn\u00e1vac\u00ed pam\u011bti p\u0159i zpracov\u00e1n\u00ed speci\u00e1ln\u011b form\u00e1tovan\u00fdch komprimovan\u00fdch dat. Podle \u00fadaj\u016f od Google m\u016f\u017ee b\u00fdt zranitelnost vyu\u017eita k vzd\u00e1len\u00e9mu spu\u0161t\u011bn\u00ed k\u00f3du p\u0159i \u00fatoku na projekty, kter\u00e9 pou\u017e\u00edvaj\u00ed ofici\u00e1ln\u00ed implementaci dekod\u00e9ru Brotli. Mezi zraniteln\u00fdmi projekty jsou: Node.js, Bun, Envoy, Istio, webov\u00e9 prohl\u00ed\u017ee\u010de, proxy servery, HTTP klienti, HTTP servery, archiva\u010dn\u00ed programy, proxy servery, UEFI firmware, prohl\u00ed\u017ee\u010de JPEG XL, dek\u00f3dovac\u00ed knihovny pro Python, Ruby, Java, PHP a .NET a souvisej\u00edc\u00ed z\u00e1vislosti. <\/p>\n
Probl\u00e9m byl identifikov\u00e1n spole\u010dnost\u00ed OpenAI v \u00fanoru tohoto roku a byl zablokov\u00e1n v k\u00f3du Brotli prost\u0159ednictv\u00edm odm\u00edtnut\u00ed neplatn\u00fdch tok\u016f p\u0159i dek\u00f3dov\u00e1n\u00ed. 22. \u0159\u00edjna byly zve\u0159ejn\u011bny opravy Brotli 1.0.10, 1.1.1 a 1.2.1, ve kter\u00fdch byla jasn\u011b uvedena oprava zranitelnosti a vy\u0159e\u0161en z\u00e1kladn\u00ed probl\u00e9m. T\u00e9ho\u017e dne byl vytvo\u0159en prototyp exploitu, kter\u00fd umo\u017enil vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du v laboratorn\u00edch podm\u00ednk\u00e1ch, p\u0159i pou\u017eit\u00ed nestandardn\u00edch sestaven\u00ed (ve standardn\u00edch sestaven\u00edch do\u0161lo k hav\u00e1rii). Pozd\u011bji spole\u010dnost Imperva zaznamenala \u00fatok na standardn\u00ed sestaven\u00ed Node.js 24.22.0 v linuxov\u00e9m prost\u0159ed\u00ed na syst\u00e9mu ARM64.<\/p>\n
Zranitelnost vede k z\u00e1pisu za hranice vyrovn\u00e1vac\u00ed pam\u011bti kv\u016fli nespr\u00e1vn\u00e9mu zpracov\u00e1n\u00ed chyb p\u0159i anal\u00fdze blok\u016f v komprimovan\u00e9m toku. Funkce DecodeBlockTypeAndLength() m\u00edsto chybov\u00e9ho k\u00f3du vracela pouze hodnoty true a false, co\u017e neumo\u017e\u0148ovalo volaj\u00edc\u00edmu k\u00f3du rozli\u0161it po\u0161kozen\u00ed toku od stavu, kter\u00fd vy\u017eadoval p\u0159ed\u00e1n\u00ed dal\u0161\u00edch dat do funkce. Pokud byl v toku uveden neplatn\u00fd typ bloku komprimovan\u00fdch dat, dekod\u00e9r tento stav nevn\u00edmal jako chybu, ale jako stav nedostatku dat, kter\u00fd vy\u017eadoval dal\u0161\u00ed \u010dten\u00ed z toku. Proto\u017ee v\u0161ak vyhrazen\u00e1 vyrovn\u00e1vac\u00ed pam\u011b\u0165 nebyla ur\u010dena pro dodate\u010dn\u011b p\u0159e\u010dten\u00e1 data, byly zaps\u00e1ny do oblasti mimo jej\u00ed hranice, kde bylo ulo\u017eeno vnit\u0159n\u00ed stavu dekod\u00e9ru.<\/p>\n
Referen\u010dn\u00ed knihovna brotli, probl\u00e9m se projevuje od vyd\u00e1n\u00ed 1.0.3 a byl odstran\u011bn v aktualizac\u00edch 1.0.10, 1.1.1 a 1.2.1. Zranitelnost se t\u00fdk\u00e1 aplikac\u00ed a knihoven vyu\u017e\u00edvaj\u00edc\u00edch knihovnu libbrotlidec.\n
Probl\u00e9m platformy Node.js na b\u00e1zi JavaScript byl vy\u0159e\u0161en v aktualizac\u00edch 26.12.1, 24.22.1 a 22.23.4. Napadeny mohou b\u00fdt aplikace, kter\u00e9 k po\u017eadov\u00e1n\u00ed extern\u00edho obsahu pou\u017e\u00edvaj\u00ed metodu fetch(), je\u017e automaticky dek\u00f3duje HTTP odpov\u011bdi se z\u00e1hlav\u00edm \u201eContent-Encoding: br\u201c. Zranitelnost se tak\u00e9 projevuje p\u0159i p\u0159\u00edm\u00e9m vol\u00e1n\u00ed metod zlib.brotliDecompress*(), createBrotliDecompress() a brotli.decompress() pro rozbalen\u00ed extern\u00edho obsahu nebo p\u0159i p\u0159\u00edjmu HTTP po\u017eadavk\u016f zpracov\u00e1van\u00fdch pomoc\u00ed knihoven Express 5 a body-parser 2.x.\n
Python bal\u00ed\u010dky brotli a brotlicffi (oprava navr\u017eena ve verzi 1.2.1) a projekty, kter\u00e9 je pou\u017e\u00edvaj\u00ed, mezi nimi\u017e jsou popul\u00e1rn\u00ed knihovny urllib3, aiohttp, httpx a Scrapy, kter\u00e9 dek\u00f3duj\u00ed odpov\u011bdi se z\u00e1hlav\u00edm \u201eContent-Encoding: br\u201c p\u0159i p\u0159\u00edstupu k extern\u00edm webov\u00fdm zdroj\u016fm.\n
HTTP servery, HTTP proxy, HTTP klienti a webov\u00e9 prohl\u00ed\u017ee\u010de, kter\u00e9 podporuj\u00ed kompresi Brotli (\u201eAccept-Encoding: br\u201c). V Apache httpd je dod\u00e1v\u00e1n mod_brotli (ve v\u00fdchoz\u00edm nastaven\u00ed vypnut\u00fd). Pro nginx je k dispozici extern\u00ed modul ngx_brotli (verze brotli v z\u00e1vislostech byla aktualizov\u00e1na na aktu\u00e1ln\u00ed). V Chrome\/Chromium a Firefoxu byla probl\u00e9m ji\u017e vy\u0159e\u0161ena v jedn\u00e9 z minul\u00fdch aktualizac\u00ed.serveru<\/a> Envoy byla zranitelnost vy\u0159e\u0161ena ve verz\u00edch 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12.\n