{"id":102300,"date":"2021-11-16T21:36:39","date_gmt":"2021-11-16T19:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm"},"modified":"2021-11-16T21:36:39","modified_gmt":"2021-11-16T19:36:39","slug":"uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","title":{"rendered":"Haavatavus, mis v\u00f5imaldas v\u00e4lja anda v\u00e4rskenduse igale NPM hoidlas olevale paketile","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub andis teada kahest juhtumist NPM pakirepositorios. 2. novembril teatasid v\u00e4lised turvauurijad (Kajetan Grzybowski ja Maciej Piechota) Bug Bounty programmi raames, et NPM-repos on haavatav, v\u00f5imaldades iga\u00fchel avaldada uue versiooni mis tahes paketist, kasutades selleks oma kontot, mis ei ole volitatud selliste uuenduste tegemiseks. <\/p>\n

Haavatavus tekkis \u00f5iguste kontrollimise vale teostamise t\u00f5ttu NPM-iga tegeleva mikroteenuse koodis. Volituste teenus kontrollis pakettide juurdep\u00e4\u00e4su\u00f5igusi p\u00e4ringus edastatavate andmete alusel, kuid teine teenus, mis laadis v\u00e4rskendust reposse, m\u00e4\u00e4ras avaldamiseks paketi \u00fcles laaditud paketi metainformatsiooni alusel. Sel moel v\u00f5is r\u00fcndaja taotleda v\u00e4rskenduse avaldamist oma paketile, millele tal on juurdep\u00e4\u00e4s, kuid pakendis ise m\u00e4rkida teise paketi teavet, mis l\u00f5puks uuendatuks osutus. <\/p>\n

Probleem lahendati 6 tunni jooksul p\u00e4rast haavatavusest teate saamist, kuid haavatavus oli NPM-is liikvel kauem, kui telemeetriaprotokollide logid n\u00e4itavad. GitHub v\u00e4idab, et alates 2020. aasta septembrist ei ole registreeritud r\u00fcnnakute j\u00e4lgi, mis kasutavad seda haavatavust, kuid puuduvad garantiid, et probleem ei olnud varem \u00e4ra kasutatud. <\/p>\n

Teine intsident toimus 26. oktoobril. Teenuse replicate.npmjs.com andmebaasi tehniliste t\u00f6\u00f6de k\u00e4igus tuvastati, et avalikult ligip\u00e4\u00e4setavas andmebaasis olid konfidentsiaalsed andmed, mis paljastavad teavet sisepakettide nimede kohta, mis olid mainitud muudatuste logis. Selliste nimede teavet v\u00f5idakse kasutada r\u00fcnnakute sooritamiseks siseprojektide s\u00f5ltuvustele (veebruaris v\u00f5imaldas sarnane r\u00fcnnak koodi k\u00e4ivitada serverites<\/a> PayPal, Microsoft, Apple, Netflix, Uber ja veel 30 ettev\u00f5tet). <\/p>\n

Lisaks on seoses suurenenud juhtumite arvu jaotumisega suurte projektide hoidlate haaramiseks ning pahavara koodi edendamisega l\u00e4bi arendajate kontode kompimise, otsustanud ettev\u00f5te GitHub kehtestada kohustusliku kahefaktorilise autentimise. Muutus j\u00f5ustub 2022. aasta esimeses kvartalis ning puudutab haldajaid ja pakettide administraatoreid, mis on loetletud populaarsemate seas. Samuti teavitatakse infrastruktuuri uuendamisest, kus rakendatakse automatiseeritud j\u00e4lgimist ja anal\u00fc\u00fcsi uute versioonide paketid, et varakult tuvastada pahatahtlikke muudatusi. <\/p>\n

Tulet meelde, et 2020. aastal l\u00e4bi viidud uuringu kohaselt kasutavad vaid 9,27% pakettide hooldajatest sisselogimise kaitsmiseks kahefaktorilist autentimist ning 13,37% juhtudest \u00fcritasid arendajad uute kontode registreerimise ajal taaskasutada v\u00e4lja lekkinud paroolide t\u00f5ttu komplitseeritud paroole. Paroolide usaldusv\u00e4\u00e4rsuse kontrollimisel saadi ligi 12% NPM kontodele (13% pakettidest) kergesti ennustatavate ja triviaalsete paroolide, n\u00e4iteks '123456', kasutamise t\u00f5ttu. Probleemseid kontosid oli nelja Top20 populaarseima paketi seast, 13 kontot, mille pakette allalaaditi \u00fcle 50 miljoni korra kuus, 40 - enam kui 10 miljoni allalaadimisega kuus ja 282, millel oli \u00fcle 1 miljoni allalaadimise kuus. Arvesse v\u00f5ttes s\u00f5ltuvuste ahelas moodulite allalaadimist, v\u00f5is ebaturvaliste kontode rikkumine m\u00f5jutada kokku kuni 52% k\u00f5igist NPM moodulitest.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0432\u0443\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM. 2 \u043d\u043e\u044f\u0431\u0440\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (Kajetan Grzybowski \u0438 Maciej Piechota) \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Bug Bounty \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0441\u0432\u043e\u044e \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u043d\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102300","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Haavatavus, mis lubas v\u00e4ljastada uuenduse mis tahes paketile NPM reposis | ProHoster","description":"GitHub teatas kahest juhtumist NPM pakireposiidi infrastruktuuris. 2. novembril teatasid v\u00e4lised turvauuringud (Kajetan Grzybowski ja Maciej Piechota) Bug Bounty programmi raames, et NPM reposis on haavatavus, mis v\u00f5imaldab avaldada uue versiooni mis tahes paketist, kasutades selleks oma kontot, mis pole volitatud selliste uuenduste tegemiseks. Haavatavus tekkis","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0432\u0443\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM. 2 \u043d\u043e\u044f\u0431\u0440\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (Kajetan Grzybowski \u0438 Maciej Piechota) \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Bug Bounty \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0441\u0432\u043e\u044e \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u043d\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-16T19:36:39+00:00","article:modified_time":"2021-11-16T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102300","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-16 19:37:47","updated":"2022-10-03 22:09:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=102300"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102300\/revisions"}],"predecessor-version":[{"id":164408,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/102300\/revisions\/164408"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=102300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=102300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=102300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}