{"id":101180,"date":"2021-09-02T22:22:53","date_gmt":"2021-09-02T20:22:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-pac-resolver-naschityvayushhem-3-mln-zagruzok-v-nedelyu"},"modified":"2021-09-02T22:22:53","modified_gmt":"2021-09-02T20:22:54","slug":"uyazvimost-v-npm-pakete-pac-resolver-naschityvayushhem-3-mln-zagruzok-v-nedelyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-npm-pakete-pac-resolver-naschityvayushhem-3-mln-zagruzok-v-nedelyu","title":{"rendered":"S\u00e5rbarhed i NPM-pakken pac-resolver, der har 3 millioner downloads om ugen","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I NPM-pakken pac-resolver, der har over 3 millioner downloads om ugen, er der identificeret en s\u00e5rbarhed (CVE-2021-23406), der tillader udf\u00f8relse af egen JavaScript-kode i konteksten af applikationen ved at sende HTTP-anmodninger fra Node.js-projekter, der underst\u00f8tter automatisk proxykonfiguration. <\/p>\n

Pakken pac-resolver parser PAC-filer, der indeholder et script til automatisk konfiguration af proxy. PAC-filen indeholder almindelig JavaScript-kode med funktionen FindProxyForURL, der definerer logikken for valg af proxy baseret p\u00e5 v\u00e6rt og den forespurgte URL. S\u00e5rbarheden best\u00e5r i, at denne JavaScript-kode i pac-resolver blev udf\u00f8rt ved hj\u00e6lp af Node.js API'et VM, der tillader udf\u00f8relse af JavaScript-kode i en anden V8-motor kontekst. <\/p>\n

Den n\u00e6vnte API er tydeligt markeret i dokumentationen som ikke beregnet til at k\u00f8re up\u00e5lidelig kode, da den ikke giver fuld isolation af den k\u00f8rende kode og tillader adgang til den oprindelige kontekst. Problemet er l\u00f8st i version pac-resolver 5.0.0, som er blevet opdateret til at bruge biblioteket vm2, der giver en h\u00f8jere grad af isolation, der er egnet til at k\u00f8re up\u00e5lidelig kode.

\"S\u00e5rbarhed<\/center> <\/p>\n

Ved brug af den s\u00e5rbare version af pac-resolver kan en angreb udf\u00f8re sin JavaScript-kode i konteksten af koden fra et projekt, der bruger Node.js, ved at overf\u00f8re en specielt formateret PAC-fil, hvis dette projekt bruger biblioteker, der er afh\u00e6ngige af pac-resolver. Den mest popul\u00e6re af de problematiske biblioteker er Proxy-Agent, n\u00e6vnt i afh\u00e6ngighederne hos 360 projekter, inklusive urllib, aws-cdk, mailgun.js og firebase-tools, som samlet set har mere end tre millioner downloads om ugen. <\/p>\n

Hvis en applikation, der er afh\u00e6ngig af pac-resolver, indl\u00e6ser en PAC-fil, der leveres af et system, der underst\u00f8tter protokollen til automatisk proxykonfiguration WPAD, kan angribere med adgang til det lokale netv\u00e6rk udnytte distributionen af proxyindstillinger via DHCP til at inds\u00e6tte ondsindede PAC-filer.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 pac-resolver, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-23406), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438\u0437 Node.js-\u043f\u0440\u043e\u0435\u043a\u0442\u043e\u0432, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0430\u0432\u0442\u043e\u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u041f\u0430\u043a\u0435\u0442 pac-resolver \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u0440\u0430\u0437\u0431\u043e\u0440 PAC-\u0444\u0430\u0439\u043b\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043f\u0440\u043e\u043a\u0441\u0438-\u0441\u0435\u0440\u0432\u0435\u0440\u0430. PAC-\u0444\u0430\u0439\u043b \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043e\u0431\u044b\u0447\u043d\u044b\u0439 JavaScript-\u043a\u043e\u0434 \u0441 \u0444\u0443\u043d\u043a\u0446\u0438\u0435\u0439 FindProxyForURL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0435\u0439 \u043b\u043e\u0433\u0438\u043a\u0443 \u0432\u044b\u0431\u043e\u0440\u0430 \u043f\u0440\u043e\u043a\u0441\u0438 \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":101181,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101180","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed i NPM-pakken pac-resolver, der har 3 millioner downloads om ugen | ProHoster","description":"I NPM-pakken pac-resolver, der har over 3 millioner downloads om ugen, er der identificeret en s\u00e5rbarhed (CVE-2021-23406), der tillader udf\u00f8relse af egen JavaScript-kode i konteksten af applikationen ved at sende.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-npm-pakete-pac-resolver-naschityvayushhem-3-mln-zagruzok-v-nedelyu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 pac-resolver, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e | ProHoster","og:description":"\u0412 NPM-\u043f\u0430\u043a\u0435\u0442\u0435 pac-resolver, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 3 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-23406), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u043e\u0435\u0433\u043e JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043f\u0440\u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0435.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-v-npm-pakete-pac-resolver-naschityvayushhem-3-mln-zagruzok-v-nedelyu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-02T20:22:54+00:00","article:modified_time":"2021-09-02T20:22:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101180","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-02 20:46:39","updated":"2022-09-30 02:56:12","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/101180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=101180"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/101180\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/101181"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=101180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=101180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=101180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}