{"id":163792,"date":"2026-03-10T23:11:57","date_gmt":"2026-03-10T21:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy"},"modified":"2026-03-10T23:11:57","modified_gmt":"2026-03-10T21:11:59","slug":"uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","title":{"rendered":"Haavatavused projektis Pingora, mis v\u00f5imaldavad sekkuda kolmandate osapoolte p\u00e4ringutesse","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Cloudflare kuulutas v\u00e4lja kolm haavatavust Pingora raamistiku kohta, millest kahe jaoks on m\u00e4\u00e4ratud kriitiline ohtlikkuse tase (9,3 10-st). Pingora raamistik on kirjutatud Rusti keeles ja on m\u00f5eldud turvaliste, k\u00f5rge j\u00f5udlusega veebiteenuste arendamiseks. Pingora abil ehitatud proksi kasutatakse Cloudflare'i sisu kohaletoimetamise v\u00f5rgus ning see k\u00e4sitleb rohkem kui 40 miljonit p\u00e4ringut sekundis. Haavatavused on k\u00f5rvaldatud Pingora versioonis 0.8.0. <\/p>\n

Kaks k\u00f5ige ohtlikumat haavatavust v\u00f5imaldavad r\u00fcnnakute klassi «HTTP Request Smuggling», mis v\u00f5imaldavad k\u00f5rvale hiilida ligip\u00e4\u00e4supiirangute s\u00fcsteemidest ja sisestada teiste kasutajate, samas voos Frontendi ja Backendiga, t\u00f6\u00f6tlevatesse p\u00e4ringutesse. N\u00e4iteks v\u00f5ib r\u00fcnnak v\u00f5imaldada pahausliku JavaScripti koodi sisestamist teise kasutaja seanssi. Probleemid avastas Bug Bounty programmi osaleja, mis n\u00f5uab tasu haavatavuste avastamise eest. <\/p>\n

Tagasi p\u00f6\u00f6rdumise proksi kaudu backendiga suhtlemise skeemis v\u00f5tab kliendip\u00e4ringud vastu t\u00e4iendav s\u00f5lm, mis loob pikaajalise TCP-\u00fchenduse backendiga, mis tegelikult t\u00f6\u00f6tleb p\u00e4ringud. Selle kaudu edastatakse tavaliselt erinevate kasutajate p\u00e4ringud, mis liiguvad j\u00e4tkuvalt j\u00e4rjestikku, kasutades HTTP protokolli vahendeid. HTTP Request Smuggling r\u00fcnnakud tekivad HTTP p\u00e4iste ja protokollide erinevast t\u00f5lgendamisest frontendides ja backendides, n\u00e4iteks siis, kui front end m\u00e4\u00e4rab p\u00e4ringu suuruse HTTP p\u00e4ise «Content-Length» kaudu, samas kui backend kasutab «Transfer-Encoding: chunked». <\/p>\n

Esimene haavatavus CVE-2026-2835 esineb HTTP\/1.0 p\u00e4ringute anal\u00fc\u00fcsi koodis ja on p\u00f5hjustatud «Transfer-Encoding» p\u00e4ise eba\u00f5igest k\u00e4itamisest mitme v\u00e4\u00e4rtusega, samuti \u00fchenduse sulgemise kasutamisest p\u00e4ringu kehariba l\u00f5pu tunnusena (close-delimited). Pingora kontrollis ainult «Transfer-Encoding: chunked» varianti ja ignoreeris seda p\u00e4ist, kui seal oli mitu v\u00e4\u00e4rtust. Sellises olukorras ei pidanud Pingora «Content-Length» p\u00e4ises m\u00e4rgitud suurust arvesse, vaid pidas p\u00e4ringu kehaks k\u00f5iki andmeid, mis saadi enne \u00fchenduse sulgemist. <\/p>\n

Mitu v\u00e4\u00e4rtust «Transfer-Encoding» p\u00e4ises andis r\u00fcndajale v\u00f5imaluse luua tingimused, kus backendile suunati p\u00e4ring, mille tegelik suurus ei vastanud chunked-ahela suurusele, mis arvutati «Transfer-Encoding» p\u00e4ise p\u00f5hjal. Pingora suunab k\u00f5ik saadud andmed kui \u00fche p\u00e4ringu, samas kui backend, n\u00e4iteks Node.js, arvutab p\u00e4ringu «Transfer-Encoding: chunked» p\u00f5hjal ja t\u00f6\u00f6tleb \u00fclej\u00e4\u00e4nud j\u00e4seme kui teise p\u00e4ringu algust. GET \/ HTTP\/1.0 Host: example.com Connection: keep-alive Transfer-Encoding: identity, chunked Content-Length: 29 0 GET \/admin HTTP\/1.1 X:

\"Haavatavused<\/center> <\/p>\n

Teine haavatavus CVE-2026-2833 tuleneb HTTP\/1.1 p\u00e4ringutes HTTP-pealkirja \u201eUpgrade\u201c eba\u00f5igest k\u00e4sitlemisest. Kui p\u00e4ring sisaldab pealkirja \u201eUpgrade\u201c, edastab vahetus kohe backendile \u00fclej\u00e4\u00e4nud p\u00e4ringu andmed, ootamata backendilt vastust koodiga 101 (Switching Protocols). Selle t\u00f5ttu h\u00e4iritakse voogede s\u00fcnkroonimist vahetuse ja backendiga ning backend t\u00f5lgendab p\u00e4rast pealkirja \u201eUpgrade\u201c edastatud andmeid kui eraldi p\u00e4ringut, saates selle p\u00e4ringu t\u00e4itmise tulemuse vastuseks j\u00e4rgnenud teise kasutaja p\u00e4ringule. GET \/ HTTP\/1.1 Host: example.com Upgrade: foo GET \/admin HTTP\/1.1 Host: example.com

\"Haavatavused<\/center>
\"Haavatavused<\/center> <\/p>\n

Probleemid ilmnevad, kui Pingorat kasutatakse p\u00f6\u00f6rdproxy (ingress proxy) vormis, mis edastab kasutajate p\u00e4ringud backendidele protokollide HTTP\/1.0 v\u00f5i HTTP\/1.1 abil. Cloudflare'i sisu edastamise v\u00f5rgu konfiguratsioon Pingora ei v\u00f5imaldanud haavatavusi \u00e4ra kasutada, kuna Pingorat ei kasutata CDN-is ingress-proxyna, edastades p\u00e4ringud ainult HTTP\/1.1 protokolles, blokeerides p\u00e4ringud, millel on ebat\u00e4psed Content-Length v\u00e4\u00e4rtused, edastades ainult \u00fche pealkirja \u201eTransfer-Encoding: chunked\u201c ning lisades p\u00e4ringutesse pealkirja \u201eUpgrade:\u201c juurde liigse pealkirja \u201eConnection: close\u201c, mis ei v\u00f5imalda edastada t\u00e4iendavaid p\u00e4ringuid samas \u00fchenduses. <\/p>\n

Kolmas haavatavus CVE-2026-2836 (ohtlikkuse aste 8.4 skaalal 10) viib vahem\u00e4lu m\u00fcrgitamiseni (cache poisoning) andmete vahem\u00e4lu paigutusv\u00f5tme (CacheKey) genereerimise t\u00f5ttu ainult URI teest, j\u00e4ttes k\u00f5rvale pealkirja \u201eHost\u201c sisu. Selline puuduj\u00e4\u00e4k toob kaasa sarnaste vahem\u00e4lu v\u00f5tmete moodustumise sama HTTP-teega erinevatele hostidele. Haavatavust saab kasutada vahem\u00e4lu sisu asendamiseks, kui kasutatakse vahem\u00e4lu re\u017eiimi mitme hosti jaoks. Pingoras on vahem\u00e4lustamine eksperimentaalne funktsioon, mida ei soovitata tootmiskeskkondades kasutada.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Pingora, \u0434\u0432\u0443\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10). \u0424\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a Pingora \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432. \u041f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Pingora \u043f\u0440\u043e\u043a\u0441\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Cloudflare \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 40 \u043c\u043b\u043d \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432 \u0441\u0435\u043a\u0443\u043d\u0434\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":163793,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-163792","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pingora projekti haavatavused, mis v\u00f5imaldavad kolmanda osapoole p\u00e4ringutesse sekkuda | ProHoster","description":"Cloudflare teatas Pingora raamistikus kolme haavatavuse k\u00f5rvaldamisest, millest kahel on kriitiline ohtude tase (9,3 skaalal 10).","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0435 Pingora, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u043a\u043b\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Pingora, \u0434\u0432\u0443\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10).","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-10T21:11:59+00:00","article:modified_time":"2026-03-10T21:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/163792","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=163792"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/163792\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/163793"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=163792"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=163792"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=163792"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}