{"id":102176,"date":"2021-11-02T03:36:46","date_gmt":"2021-11-02T01:36:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster"},"modified":"2021-11-02T03:36:46","modified_gmt":"2021-11-02T01:36:46","slug":"uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster","title":{"rendered":"Haavatavus, mis v\u00f5imaldab JavaScripti koodi sisestamist kaudu WordPressi plugin OptinMonster.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

WordPressi OptinMonsteri lisandmoodulis, millel on \u00fcle miljoni aktiivse paigaldamise ja mis on m\u00f5eldud h\u00fcpikakende ja pakkumiste kuvamiseks, on tuvastatud haavatavus (CVE-2021-39341), mis v\u00f5imaldab paigutada oma JavaScripti koodi veebisaidile, mis kasutab antud lisandmoodulit. Haavatavus on k\u00f5rvaldatud versioonis 2.6.5. Juurdep\u00e4\u00e4su blokeerimiseks varastatud v\u00f5tmete kaudu p\u00e4rast uuenduse installimist t\u00fchistasid OptinMonsteri arendajad k\u00f5ik varasemad API juurdep\u00e4\u00e4su v\u00f5tmed ja kehtestasid piirangud WordPressi saitide v\u00f5tmete kasutamiseks OptinMonsteri kampaaniate muutmiseks. <\/p>\n

Probleem on p\u00f5hjustatud REST-API-st \/wp-json\/omapp\/v1\/support, millele p\u00e4\u00e4seti juurde ilma autentimiseta \u2014 p\u00e4ring tehti lisakontrollideta, kui Referer p\u00e4ises oli rida \"https:\/\/wp.app.optinmonster.test\" ja HTTP p\u00e4ringu t\u00fc\u00fcp oli seadistatud \"OPTIONS\" (\u00fclekirjutatakse HTTP p\u00e4ise \"X-HTTP-Method-Override\" abil). Tagastatud andmete seas, kui p\u00f6\u00f6rduti k\u00f5nealuse REST-API poole, oli juurdep\u00e4\u00e4su v\u00f5ti, mis v\u00f5imaldas saata p\u00e4ringuid mis tahes REST-API t\u00f6\u00f6tlejatele. <\/p>\n

Saadud v\u00f5tme abil sai r\u00fcndaja teha muudatusi mis tahes h\u00fcpikakendes, mida OptinMonsteri abil kuvatakse, sealhulgas k\u00e4ivitada oma JavaScripti koodi. Saades v\u00f5imaluse oma JavaScripti koodi k\u00e4ivitada r\u00fcndatava saidi kontekstis, sai r\u00fcndaja suunata kasutajad oma veebisaidile v\u00f5i korraldada privileege saava konto asendamise veebiliidese kaudu, kui veebisaidi administraator k\u00e4ivitas sisestatud JavaScripti koodi. Ligip\u00e4\u00e4suga veebiliidesele suutis r\u00fcndaja viia ellu oma PHP koodi. serveris<\/a>.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 OptinMonster, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u0432\u043e\u0434\u0430 \u0432\u0441\u043f\u043b\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-39341), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 JavaScript-\u043a\u043e\u0434 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 2.6.5. \u0414\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d\u043d\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 OptinMonster \u0430\u043d\u043d\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u0441\u0435 \u0440\u0430\u043d\u0435\u0435 \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102176","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus, mis v\u00f5imaldab JavaScripti koodi lisamist WordPressi lisandmooduli OptinMonster kaudu | ProHoster","description":"WordPressi OptinMonsteri lisandmoodulis, millel on \u00fcle miljoni aktiivse paigaldamise ja mis on m\u00f5eldud h\u00fcpikakende ja pakkumiste kuvamiseks, on tuvastatud haavatavus (CVE-2021-39341), mille abil on v\u00f5imalik paigutada.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 JavaScript-\u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d OptinMonster | ProHoster","og:description":"\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 OptinMonster, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u0432\u043e\u0434\u0430 \u0432\u0441\u043f\u043b\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-39341), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-02T01:36:46+00:00","article:modified_time":"2021-11-02T01:36:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102176","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-02 01:36:50","updated":"2026-02-09 21:39:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102176","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102176"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102176\/revisions"}],"predecessor-version":[{"id":159966,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102176\/revisions\/159966"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102176"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}