{"id":100603,"date":"2021-06-25T22:22:49","date_gmt":"2021-06-25T20:22:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-store-kde-org-i-katalogah-opendesktop"},"modified":"2021-06-25T22:22:49","modified_gmt":"2021-06-25T20:22:49","slug":"uyazvimost-v-store-kde-org-i-katalogah-opendesktop","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-store-kde-org-i-katalogah-opendesktop","title":{"rendered":"Haavatavus store.kde.org ja OpenDesktop kataloogides.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Pling platvormile p\u00f5hinevates rakenduskataloogides on avastatud haavatavus, mis v\u00f5imaldab XSS-r\u00fcnnakut, et k\u00e4ivitada JavaScripti koodi teiste kasutajate kontekstis. Probleem on seotud selliste saitidega nagu store.kde.org, appimagehub.com, gnome-look.org, xfce-look.org ja pling.com. <\/p>\n

Probleemi olemus on see, et platvorm Pling lubab HTML-formaadis multimeedia plokkide lisamist, näiteks YouTube'i videote või piltide sisestamiseks. Vormiga lisatud koodi ei kontrollita korralikult, mis võimaldab lisada piltide all näiteks koodi «<img src="x" onerror="alert(1)">» ja kuvada kataloogis teavet, mille vaatamisel käivitatakse JavaScripti kood. Kui teave avatakse kasutajatele, kellel on konto, siis on võimalik algatada kataloogis tegevusi selle kasutaja nimel, sealhulgas lisada JavaScripti kutsed tema lehtedele, tekitades sellise sarnase võrguuss. <\/p>\n

Lisaks on avastatud haavatavus PlingStore rakenduses, mis on kirjutatud Electroni abil ja v\u00f5imaldab sirvida OpenDesktop'i katalooge ilma brauserita ning installida seal esitatud pakette. PlingStore'i haavatavus v\u00f5imaldab k\u00e4ivitada kasutaja s\u00fcsteemis oma koodi. Rakenduse PlingStore t\u00f6\u00f6tamise ajal k\u00e4ivitub t\u00e4iendav protsess ocs-manager, mis v\u00f5tab vastu kohalikke \u00fchendusi WebSocketi kaudu ja t\u00e4idab k\u00e4ske, nagu rakenduste allalaadimine ja k\u00e4ivitamine AppImage formaadis. Eeldatakse, et k\u00e4sud edastab PlingStore'i rakendus, kuid tegelikult saab autentimata t\u00f5ttu ocs-managerile p\u00e4ringu saata ka kasutaja brauserist. Kui kasutaja avab pahatahtliku saidi, v\u00f5ib ta algatada \u00fchenduse ocs-manageriga ja saavutada koodi k\u00e4ivitamise kasutaja s\u00fcsteemis. <\/p>\n

\u0422\u0430\u043a \u0436\u0435 \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442\u0441\u044f \u043e\u0431 XSS-\u0443\u044f\u0432\u0437\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 extensions.gnome.org — \u0432 \u043f\u043e\u043b\u0435 \u0441 URL \u0434\u043e\u043c\u0430\u0448\u043d\u0435\u0439 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043c\u043e\u0436\u043d\u043e \u0443\u043a\u0430\u0437\u0430\u0442\u044c JavaScript-\u043a\u043e\u0434 \u0432 \u0444\u043e\u0440\u043c\u0435 «javascript: \u043a\u043e\u0434» \u0438 \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u0441\u0441\u044b\u043b\u043a\u0435 \u0432\u043c\u0435\u0441\u0442\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u044f \u0441\u0430\u0439\u0442\u0430 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0431\u0443\u0434\u0435\u0442 \u0437\u0430\u043f\u0443\u0449\u0435\u043d \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u044b\u0439 JavaScript. \u0421 \u043e\u0434\u043d\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u043e\u0441\u0438\u0442 \u0431\u043e\u043b\u044c\u0448\u0435 \u0443\u043c\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0445\u0430\u0440\u0430\u043a\u0442\u0435\u0440, \u0442\u0430\u043a \u043a\u0430\u043a \u0440\u0430\u0437\u043c\u0435\u0449\u0435\u043d\u0438\u0435 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 extensions.gnome.org \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u0435\u043c\u043e\u0434\u0435\u0440\u0430\u0446\u0438\u044e \u0438 \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043e\u0442\u043a\u0440\u044b\u0442\u0438\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u043e\u0439 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b, \u043d\u043e \u0438 \u044f\u0432\u043d\u044b\u0439 \u043a\u043b\u0438\u043a \u043f\u043e \u0441\u0441\u044b\u043b\u043a\u0435. \u0421 \u0434\u0440\u0443\u0433\u043e\u0439 \u0441\u0442\u043e\u0440\u043e\u043d\u044b, \u043d\u0435 \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u043e, \u0447\u0442\u043e \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u043c\u043e\u0434\u0435\u0440\u0430\u0442\u043e\u0440 \u043f\u043e\u0436\u0435\u043b\u0430\u0435\u0442 \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043d\u0430 \u0441\u0430\u0439\u0442 \u043f\u0440\u043e\u0435\u043a\u0442\u0430, \u043d\u0435 \u043e\u0431\u0440\u0430\u0442\u0438\u0442 \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u043d\u0430 \u0444\u043e\u0440\u043c\u0443 \u0441\u0441\u044b\u043b\u043a\u0438 \u0438 \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442 JavaScript-\u043a\u043e\u0434 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0441\u0432\u043e\u0435\u0439 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Pling, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0438\u0442\u044c XSS-\u0430\u0442\u0430\u043a\u0443 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0442\u0430\u043a\u0438\u0435 \u0441\u0430\u0439\u0442\u044b, \u043a\u0430\u043a store.kde.org, appimagehub.com, gnome-look.org, xfce-look.org \u0438 pling.com. \u0421\u0443\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 Pling \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0431\u043b\u043e\u043a\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 HTML, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u0432\u0441\u0442\u0430\u0432\u043a\u0438 \u0440\u043e\u043b\u0438\u043a\u0430 \u0441 YouTube \u0438\u043b\u0438 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f. \u0414\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0439 \u0447\u0435\u0440\u0435\u0437 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100603","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Turvalisus store.kde.org ja OpenDesktop'i kataloogides | ProHoster","description":"Pling-i platvormil p\u00f5hinevates rakenduste kataloogides on avastatud haavatavus, mis v\u00f5imaldab XSS-r\u00fcnnakut JavaScript-koodi t\u00e4itmiseks teiste kasutajate kontekstis. Probleemiga on seotud sellised saidid nagu store.kde.org, appimagehub.com, gnome-look.org, xfce-look.org ja pling.com. Probleemi olemus seisneb selles, et Pling-i platvorm lubab lisada multimeedia blokke HTML-formaadis, n\u00e4iteks YouTube'i video v\u00f5i pildi sisestamiseks. Lisatud kaudu","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-store-kde-org-i-katalogah-opendesktop","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 store.kde.org \u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u0445 OpenDesktop | ProHoster","og:description":"\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0445 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Pling, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0441\u043e\u0432\u0435\u0440\u0448\u0438\u0442\u044c XSS-\u0430\u0442\u0430\u043a\u0443 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u044b \u0442\u0430\u043a\u0438\u0435 \u0441\u0430\u0439\u0442\u044b, \u043a\u0430\u043a store.kde.org, appimagehub.com, gnome-look.org, xfce-look.org \u0438 pling.com. \u0421\u0443\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 Pling \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043c\u0443\u043b\u044c\u0442\u0438\u043c\u0435\u0434\u0438\u0439\u043d\u044b\u0445 \u0431\u043b\u043e\u043a\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 HTML, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u0432\u0441\u0442\u0430\u0432\u043a\u0438 \u0440\u043e\u043b\u0438\u043a\u0430 \u0441 YouTube \u0438\u043b\u0438 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f. \u0414\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0439 \u0447\u0435\u0440\u0435\u0437","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-store-kde-org-i-katalogah-opendesktop","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-06-25T20:22:49+00:00","article:modified_time":"2021-06-25T20:22:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100603","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-06-25 20:33:37","updated":"2022-09-30 01:54:12"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=100603"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100603\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=100603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=100603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=100603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}