{"id":102300,"date":"2021-11-16T21:36:39","date_gmt":"2021-11-16T19:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm"},"modified":"2021-11-16T21:36:39","modified_gmt":"2021-11-16T19:36:39","slug":"uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","title":{"rendered":"S\u00e5rbarhed, der gjorde det muligt at frigive opdateringer for enhver pakke i NPM-repositoriet.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub har afsl\u00f8ret oplysninger om to h\u00e6ndelser i infrastrukturen for NPM-pakkeopbevaringen. Den 2. november informerede eksterne sikkerhedsforskere (Kajetan Grzybowski og Maciej Piechota) i forbindelse med Bug Bounty-programmet om en s\u00e5rbarhed i NPM-opbevaringen, der g\u00f8r det muligt at offentligg\u00f8re en ny version af enhver pakke ved at bruge en konto, der ikke er autoriseret til at udf\u00f8re s\u00e5danne opdateringer. <\/p>\n

S\u00e5rbarheden blev for\u00e5rsaget af mangelfuld kontrol af de bef\u00f8jelser, der var i mikrotjenesterne, der behandlede foresp\u00f8rgsler til NPM. Autorisationstjenesten udf\u00f8rte kontrol af adgangsrettighederne til pakker baseret p\u00e5 de data, der blev sendt med foresp\u00f8rgslen, men en anden tjeneste, der opdaterede opbevaringen, bestemte, hvilken pakke der skulle offentligg\u00f8res baseret p\u00e5 metadataindholdet i den uploadede pakke. P\u00e5 den m\u00e5de kunne en angriber anmode om offentligg\u00f8relse af en opdatering til sin pakke, som han havde adgang til, men angive oplysninger om en anden pakke i selve pakken, som s\u00e5 endte med at blive opdateret. <\/p>\n

Problemet blev l\u00f8st seks timer efter opdagelsen af s\u00e5rbarheden, men s\u00e5rbarheden var til stede i NPM i l\u00e6ngere tid, end telemetrilogfilerne d\u00e6kker. GitHub h\u00e6vder, at der ikke er registreret spor af angreb med denne s\u00e5rbarhed siden september 2020, men der er ingen garanti for, at problemet ikke er blevet udnyttet tidligere. <\/p>\n

Den anden h\u00e6ndelse fandt sted den 26. oktober. Under teknisk arbejde med databasen for tjenesten replicate.npmjs.com blev der opdaget tilg\u00e6ngelighed af fortrolige oplysninger i en database, der var tilg\u00e6ngelig for eksterne foresp\u00f8rgsler, som afsl\u00f8rede navne p\u00e5 interne pakker, der blev n\u00e6vnt i \u00e6ndringsloggen. Oplysninger om s\u00e5danne navne kan bruges til at udf\u00f8re angreb p\u00e5 afh\u00e6ngigheder i interne projekter (i februar gav et s\u00e5dant angreb mulighed for at k\u00f8re kode p\u00e5 servere<\/a> PayPal, Microsoft, Apple, Netflix, Uber og yderligere 30 virksomheder). <\/p>\n

Derudover, p\u00e5 grund af den stigende forekomst af kr\u00e6nkelser af store projekters repository og spredning af skadelig kode gennem kompromitterede udviklerkonti, har GitHub truffet beslutning om at indf\u00f8re obligatorisk tofaktorautentificering. \u00c6ndringen tr\u00e6der i kraft i f\u00f8rste kvartal af 2022 og vil g\u00e6lde for vedligeholdere og administratorer af de mest popul\u00e6re pakker. Derudover rapporteres der om opgradering af infrastrukturen, hvor automatiseret overv\u00e5gning og analyse af nye versioner af pakker vil blive implementeret for tidligt at opdage skadelige \u00e6ndringer. <\/p>\n

Lad os minde om, at if\u00f8lge en unders\u00f8gelse fra 2020 bruger kun 9,27% af pakkevedligeholdere to-faktor-autentifikation for at beskytte adgangen, og i 13,37% af tilf\u00e6lde fors\u00f8gte udviklere at genbruge kompromitterede adgangskoder, der optr\u00e6der i kendte l\u00e6kager af adgangskoder, n\u00e5r de registrerede nye konti. Under kontrollen af p\u00e5lideligheden af de anvendte adgangskoder kunne der opn\u00e5s adgang til 12% af kontoerne i NPM (13% af pakkerne) p\u00e5 grund af brugen af forudsigelige og triviale adgangskoder, s\u00e5som \"123456\". Blandt de problematiske var der 4 brugerkonti fra Top20 de mest popul\u00e6re pakker, 13 brugerkonti, hvis pakker blev downloadet mere end 50 millioner gange om m\u00e5neden, 40 \u2013 mere end 10 millioner downloads om m\u00e5neden, og 282 med mere end 1 million downloads om m\u00e5neden. I betragtning af indl\u00e6sning af moduler gennem afh\u00e6ngighedsk\u00e6der kunne kompromittering af usikre konti ramme op til 52% af alle moduler i NPM.
\n
Kilde: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0432\u0443\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM. 2 \u043d\u043e\u044f\u0431\u0440\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (Kajetan Grzybowski \u0438 Maciej Piechota) \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Bug Bounty \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0441\u0432\u043e\u044e \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u043d\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102300","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhed, der gjorde det muligt at udgive opdateringer for enhver pakke i NPM repository | ProHoster","description":"GitHub har afsl\u00f8ret information om to h\u00e6ndelser i infrastrukturen for NPM pakke repository.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0432\u0443\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-16T19:36:39+00:00","article:modified_time":"2021-11-16T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102300","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-16 19:37:47","updated":"2022-10-03 22:09:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=102300"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102300\/revisions"}],"predecessor-version":[{"id":164408,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102300\/revisions\/164408"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=102300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=102300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=102300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}