{"id":54062,"date":"2019-12-17T00:00:00","date_gmt":"2019-12-16T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/uyazvimost-v-npm-pozvolyayushhaya-izmenit-proizvolnye-fajly-pri-ustanovke-paketa"},"modified":"2020-02-18T14:02:02","modified_gmt":"2020-02-18T11:02:02","slug":"uyazvimost-v-npm-pozvolyayushhaya-izmenit-proizvolnye-fajly-pri-ustanovke-paketa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-npm-pozvolyayushhaya-izmenit-proizvolnye-fajly-pri-ustanovke-paketa","title":{"rendered":"Eine Schwachstelle in NPM erlaubt das \u00c4ndern beliebiger Dateien bei der Installation eines Pakets.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In der Aktualisierung des Paketmanagers NPM 6.13.4, die Bestandteil von Node.js ist und zur Verbreitung von Modulen in JavaScript verwendet wird, wurden<\/a><\/noindex> wurden drei Sicherheitsl\u00fccken festgestellt (CVE-2019-16775<\/a><\/noindex>, CVE-2019-16776<\/a><\/noindex> und CVE-2019-16777<\/a><\/noindex>), die es erm\u00f6glichen, beliebige Systemdateien w\u00e4hrend der Installation eines von einem Angreifer vorbereiteten Pakets zu modifizieren oder zu \u00fcberschreiben. Ein m\u00f6glicher Umweg zur Umgehung des Schutzes kann die Installation mit der Option «—ignore-scripts» sein, die die Ausf\u00fchrung integrierter Paket-Handler untersagt. Die Entwickler von NPM haben die in den Repositories vorhandenen Pakete analysiert und keine Hinweise auf eine Nutzung der identifizierten Probleme f\u00fcr Angriffe gefunden.<\/p>\n

  • CVE-2019-16777 zeigt sich<\/a><\/noindex> in Versionen vor 6.13.4 und erm\u00f6glicht das \u00dcberschreiben von systemweiten ausf\u00fchrbaren Dateien w\u00e4hrend der globalen Installation eines Pakets. Es k\u00f6nnen nur Dateien im Zielverzeichnis ersetzt werden, in das die ausf\u00fchrbaren Dateien installiert werden (gew\u00f6hnlich \/usr\/local\/bin).\n
  • CVE-2019-16775<\/a><\/noindex> und CVE-2019-16776<\/a><\/noindex> kommen in Versionen bis 6.13.3 vor und erm\u00f6glichen es, eine beliebige Datei zu schreiben, indem eine symbolische Verkn\u00fcpfung zu Dateien au\u00dferhalb des Modulkatalogs (node_modules) erstellt wird oder durch Manipulation des bin-Felds in package.json (im bin-Feld war die Verwendung von Pfaden mit «\\\/..\\\/» zul\u00e4ssig).\n

    <\/a><\/noindex><\/p>\n

    Quelle: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0412 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 NPM 6.13.4, \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0443 Node.js \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 JavaScript, \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-16775, CVE-2019-16776 \u0438 CVE-2019-16777), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u0440\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u0412 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u044b \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0441 \u043e\u043f\u0446\u0438\u0435\u0439 «—ignore-scripts», \u0437\u0430\u043f\u0440\u0435\u0449\u0430\u044e\u0449\u0435\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0445 \u043f\u0430\u043a\u0435\u0442\u044b \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 NPM […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54062","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sicherheitsanf\u00e4lligkeit in NPM erm\u00f6glicht die \u00c4nderung beliebiger Dateien bei der Installation eines Pakets | ProHoster","description":"In der Aktualisierung des Paketmanagers NPM 6.13.4, die Bestandteil von Node.js ist und zur Verbreitung von Modulen in JavaScript verwendet wird,","canonical_url":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-npm-pozvolyayushhaya-izmenit-proizvolnye-fajly-pri-ustanovke-paketa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 NPM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043f\u0440\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 | ProHoster","og:description":"\u0412 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0430 NPM 6.13.4, \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0433\u043e \u0432 \u043f\u043e\u0441\u0442\u0430\u0432\u043a\u0443 Node.js \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043c\u043e\u0434\u0443\u043b\u0435\u0439 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 JavaScript,","og:url":"https:\/\/prohoster.info\/de\/blog\/news\/uyazvimost-v-npm-pozvolyayushhaya-izmenit-proizvolnye-fajly-pri-ustanovke-paketa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-16T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:02+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54062","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 09:55:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:12:24","updated":"2026-01-24 09:55:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/54062","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=54062"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/54062\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=54062"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=54062"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=54062"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}