{"id":101617,"date":"2021-10-13T10:22:48","date_gmt":"2021-10-13T08:22:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/iz-kataloga-pypi-udaleny-vredonosnye-pakety-mitmproxy2-i-mitmproxy-iframe"},"modified":"2021-10-13T10:22:48","modified_gmt":"2021-10-13T08:22:48","slug":"iz-kataloga-pypi-udaleny-vredonosnye-pakety-mitmproxy2-i-mitmproxy-iframe","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/iz-kataloga-pypi-udaleny-vredonosnye-pakety-mitmproxy2-i-mitmproxy-iframe","title":{"rendered":"Malicious packages mitmproxy2 and mitmproxy-iframe have been removed from the PyPI directory","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The author of mitmproxy, a tool for analyzing HTTP\/HTTPS traffic, noted the emergence in the Python Package Index (PyPI) of a fork of his project. The fork was distributed under a similar name, mitmproxy2, and a non-existent version 8.0.1 (the current release of mitmproxy is 7.0.4), with the expectation that inattentive users would perceive the package as a new edition of the main project (typosquatting) and would want to try out the new version. <\/p>\n
In terms of its composition, mitmproxy2 was similar to mitmproxy, with the exception of changes that implemented malicious functionality. The changes included the removal of the HTTP header 'X-Frame-Options: DENY', which prohibits content processing within an iframe, the disabling of XSRF protection, and the setting of the headers 'Access-Control-Allow-Origin: *', 'Access-Control-Allow-Headers: *', and 'Access-Control-Allow-Methods: POST, GET, DELETE, OPTIONS'. <\/p>\n
These changes removed access restrictions to the HTTP API used to control mitmproxy via the web interface, which allowed any attacker on the same local network to execute their code on the user's system by sending an HTTP request. <\/p>\n
The directory administration agreed that the changes made could be interpreted as malicious, and the package itself was an attempt to promote another product as if it were the main project (the package description claimed it was a new version of mitmproxy, not a fork). After the package was removed from the directory, the next day a new package, mitmproxy-iframe, was posted in PyPI, the description of which also completely matched the official package. The mitmproxy-iframe package has also been removed from the PyPI directory. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"