{"id":102300,"date":"2021-11-16T21:36:39","date_gmt":"2021-11-16T19:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm"},"modified":"2021-11-16T21:36:39","modified_gmt":"2021-11-16T19:36:39","slug":"uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","title":{"rendered":"Haavatavus, mis v\u00f5imaldas v\u00e4lja anda uuendusi mis tahes pakettide jaoks NPM hoidlas","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub avaldas teavet kahe NPM pakirepositoors\u00fcsteemi infrastruktuuri Incidendi kohta. 2. novembril teatasid v\u00e4lised turvaeksperdid (Kajetan Grzybowski ja Maciej Piechota) Bug Bounty programmi raames, et NPM repositooriumis on haavatavust, mis v\u00f5imaldab avaldada uusi versioone mistahes paketist, kasutades selleks oma kontot, mis ei ole autoriseeritud sellisteks uuendusteks. <\/p>\n

Haavatavus oli p\u00f5hjustatud volituste vale kontrollimise t\u00f5ttu NPM-i p\u00e4ringute k\u00e4sitlemisel mikroteenuste koodis. Autentimis\u00adteenus kontrollis pakettide juurdep\u00e4\u00e4su\u00f5igusi p\u00e4ringus edastatud andmete p\u00f5hjal, kuid teine teenus, mis laadis uuenduse repositooriumisse, m\u00e4\u00e4ras avaldamiseks m\u00f5eldud paketi \u00fcles laaditud paketi metaandmete sisu alusel. Niisiis sai r\u00fcndaja taotleda oma paketi uuenduse avaldamist, millele tal on juurdep\u00e4\u00e4s, kuid esitada paketi sees teise paketi teabe, mis siis l\u00f5puks uuendati. <\/p>\n

Probleem lahendati kuue tunni jooksul p\u00e4rast haavatavuse avastamist, kuid haavatavus p\u00fcsis NPM-is kauem, kui telemeetrialogid katavad. GitHub v\u00e4idab, et alates 2020. aasta septembrist ei ole r\u00fcnnakute j\u00e4lgi selle haavatavuse kasutamise kohta registreeritud, kuid ei ole mingeid garante, et probleem ei olnud varem \u00e4ra kasutatud. <\/p>\n

Teine intsident juhtus 26. oktoobril. Replicate.npmjs.com teenuse andmebaasi tehniliste t\u00f6\u00f6de k\u00e4igus avastati, et v\u00e4listele p\u00e4ringutele juurdep\u00e4\u00e4setav andmebaas sisaldas konfidentsiaalset teavet, mis paljastas sisemiste paketnameede nimesid, mis olid mainitud muutuste logis. Selliste nimede teave v\u00f5ib olla kasutatud r\u00fcnnakute teostamiseks s\u00f5ltuvustele sisemistes projektides (veebruaris v\u00f5imaldas sarnane r\u00fcnnak koodi t\u00e4itmist PayPali, Microsofti, Apple'i, Netflixi, Uberi ja veel 30 ettev\u00f5ttega). serverites<\/a> PayPal, Microsoft, Apple, Netflix, Uber ja veel 30 ettev\u00f5tet). <\/p>\n

Seet\u00f5ttu, arvestades suurenenud juhtumeid suurte projektide repositorite h\u00f5ivamisest ja pahavara koodi edendamisest arendajate kontode kompromiteerimise kaudu, v\u00f5ttis ettev\u00f5te GitHub vastu otsuse kehtestada kohustuslik kahe faktoriga autentimine. Muudatus j\u00f5ustub 2022. aasta esimeses kvartalis ja rakendub k\u00f5ige populaarsemate pakettide hooldajatele ja administraatoritele. T\u00e4iendavalt teatatakse infrastruktuuri uuendamisest, kuhu rakendatakse automatiseeritud j\u00e4lgimist ja uute paketiversioonide anal\u00fc\u00fcsi pahatahtlike muudatuste varajaseks tuvastamiseks. <\/p>\n

Tulet meenutada, et vastavalt 2020. aastal l\u00e4bi viidud uuringule kasutab vaid 9,27% pakettide halduritest kahefaktorilist autentimist juurdep\u00e4\u00e4su kaitsmiseks ning 13,37% juhtudest \u00fcritasid arendajad uute konto loomise ajal uuesti kasutada varastatud paroole, mis on tuntud paroolileakides. Paroolide usaldusv\u00e4\u00e4rsuse kontrollimise k\u00e4igus saadi ligi 12% NPM kontodest (13% pakettidest) t\u00e4nu ennustatavatele ja triviaalsetele paroolidele, nagu \"123456\". Probleemide hulka kuulus 4 kasutajakontot Top20 k\u00f5ige populaarsema paketi seast, 13 kontot, mille paketid on alla laaditud rohkem kui 50 miljonit korda kuus, 40 \u2014 rohkem kui 10 miljonit allalaadimist kuus ja 282, millel on rohkem kui 1 miljon allalaadimist kuus. Arvesse v\u00f5ttes s\u00f5ltuvusmoodulite allalaadimist, v\u00f5is usaldusv\u00e4\u00e4rsete kontode kompromiteerimine m\u00f5jutada kokku kuni 52% k\u00f5igist moodulitest NPM-is.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0432\u0443\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM. 2 \u043d\u043e\u044f\u0431\u0440\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (Kajetan Grzybowski \u0438 Maciej Piechota) \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Bug Bounty \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0441\u0432\u043e\u044e \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u043d\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102300","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus, mis v\u00f5imaldas v\u00e4lja anda v\u00e4rskenduse igasugusele paketile NPM repositooriumis | ProHoster","description":"Ettev\u00f5te GitHub avaldas teavet kahe NPM paketirepositsiooni infrastruktuuri juhtumi kohta.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0432\u0443\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-16T19:36:39+00:00","article:modified_time":"2021-11-16T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102300","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-16 19:37:47","updated":"2022-10-03 22:09:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102300"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102300\/revisions"}],"predecessor-version":[{"id":164408,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102300\/revisions\/164408"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}