{"id":33388,"date":"2019-10-31T21:52:18","date_gmt":"2019-10-31T18:52:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3\/"},"modified":"2019-10-31T21:52:18","modified_gmt":"2019-10-31T18:52:18","slug":"uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3","title":{"rendered":"Sicherheitsanf\u00e4lligkeit in der Bibliothek PharStreamWrapper, die Drupal, Joomla und Typo3 betrifft.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>In der Bibliothek <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TYPO3\/phar-stream-wrapper\">PharStreamWrapper<\/a><\/noindex>, die Handler zum Schutz vor <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49746\">Durchf\u00fchrung<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=49641\">Angriffe<\/a><\/noindex> durch das Einf\u00fcgen von Dateien im Format &#171;Phar&#187;, <noindex><a rel=\"nofollow\" href=\"https:\/\/typo3.org\/security\/advisory\/typo3-psa-2019-007\/\">entdeckt<\/a><\/noindex> <noindex><a rel=\"nofollow\" href=\"https:\/\/www.drupal.org\/sa-core-2019-007\">eine Schwachstelle<\/a><\/noindex> (<noindex><a rel=\"nofollow\" href=\"https:\/\/security-tracker.debian.org\/tracker\/CVE-2019-11831\">CVE-2019-11831<\/a><\/noindex>), die es erm\u00f6glicht, den Schutz vor Code-Desserialisierung durch das Einf\u00fcgen von Zeichen &#171;..&#187; in den Pfad zu umgehen. Beispielsweise k\u00f6nnte ein Angreifer eine URL wie &#171;phar:\/\/path\/bad.phar\/....\/good.phar&#187; verwenden, und die Bibliothek w\u00fcrde bei der \u00dcberpr\u00fcfung den Basisnamen &#171;\/path\/good.phar&#187; extrahieren, obwohl bei der weiteren Verarbeitung eines solchen Pfades die Datei &#171;\/path\/bad.phar&#187; verwendet wird.<\/p>\n<p>Die Bibliothek wurde von den Entwicklern des CMS TYPO3 erstellt, wird aber auch in den Projekten Drupal und Joomla verwendet, was sie ebenfalls anf\u00e4llig f\u00fcr diese Sicherheitsanf\u00e4lligkeit macht. Das Problem wurde in den Versionen <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/TYPO3\/phar-stream-wrapper\/releases\">PharStreamWrapper 2.1.1 und 3.1.1<\/a><\/noindex>. Das Projekt Drupal hat das Problem in den Updates 7.67, 8.6.16 und 8.7.1 behoben. In Joomla tritt das Problem seit Version 3.9.3 auf und wurde in Version 3.9.6 behoben. Um das Problem in TYPO3 zu beheben, muss die PharStreamWrapper-Bibliothek aktualisiert werden.<\/p>\n<p>Aus praktischer Sicht erm\u00f6glicht die Schwachstelle im PharStreamWrapper einem Drupal Core-Benutzer mit Administratorrechten f\u00fcr Designs (&#8216;Administer theme&#8217;), eine sch\u00e4dliche Phar-Datei hochzuladen und die darin enthaltene PHP-Codeausf\u00fchrung als legitimes Phar-Archiv durchzuf\u00fchren. Zur Erinnerung: Der Kernangriff der &#171;Phar-Desserialisierung&#187; besteht darin, dass bei der \u00dcberpr\u00fcfung hochgeladener Dateien mit der PHP-Funktion file_exists() diese Funktion automatisch die Metadaten aus Phar-Dateien (PHP Archive) beim Verarbeiten von Pfaden, die mit &#171;phar:\/\/&#187; beginnen, deserialisiert. Die \u00dcbertragung der Phar-Datei kann in Form eines Bildes erfolgen, da die Funktion file_exists() den MIME-Typ anhand des Inhalts und nicht anhand der Dateiendung bestimmt.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Quelle: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50665\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 PharStreamWrapper, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 &#171;Phar&#187;, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-11831), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u043e\u0442 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 &#171;..&#187; \u0432 \u043f\u0443\u0442\u0438. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 URL \u0432\u0438\u0434\u0430 &#171;phar:\/\/\/path\/bad.phar\/..\/good.phar&#187; \u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u0432\u044b\u0434\u0435\u043b\u0438\u0442 \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0431\u0430\u0437\u043e\u0432\u043e\u0435 \u0438\u043c\u044f &#171;\/path\/good.phar&#187;, \u0445\u043e\u0442\u044f \u043f\u0440\u0438 \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u0431\u0443\u0434\u0435\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-33388","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 PharStreamWrapper, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"de_DE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 PharStreamWrapper, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f Drupal, Joomla \u0438 Typo3 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 PharStreamWrapper, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:52:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:52:18+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sicherheitsanf\u00e4lligkeit in der Bibliothek PharStreamWrapper, die Drupal, Joomla und Typo3 betrifft | ProHoster","description":"In der Bibliothek PharStreamWrapper, die Handler zum Schutz vor","canonical_url":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 PharStreamWrapper, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f Drupal, Joomla \u0438 Typo3 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 PharStreamWrapper, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442","og:url":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:52:18+00:00","article:modified_time":"2019-10-31T18:52:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33388","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 15:01:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:41:46","updated":"2026-01-21 15:01:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/33388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=33388"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/33388\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=33388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=33388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=33388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}