{"id":100945,"date":"2021-08-08T16:22:46","date_gmt":"2021-08-08T14:22:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov"},"modified":"2021-08-08T16:22:46","modified_gmt":"2021-08-08T14:22:47","slug":"uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","title":{"rendered":"Une vuln\u00e9rabilit\u00e9 dans les biblioth\u00e8ques r\u00e9seau des langages Rust et Go, permettant de contourner la v\u00e9rification des adresses IP.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Des vuln\u00e9rabilit\u00e9s li\u00e9es \u00e0 un traitement incorrect des adresses IP avec des chiffres octaux ont \u00e9t\u00e9 identifi\u00e9es dans les biblioth\u00e8ques standard des langages Rust et Go dans les fonctions d'analyse d'adresse. Ces vuln\u00e9rabilit\u00e9s permettent de contourner les v\u00e9rifications des adresses valides dans les applications, par exemple pour acc\u00e9der aux adresses des interfaces loopback (127.x.x.x) ou aux sous-r\u00e9seaux intranet lors d'attaques SSRF (Server-side request forgery). Ces vuln\u00e9rabilit\u00e9s poursuivent le cycle de probl\u00e8mes pr\u00e9c\u00e9demment d\u00e9couverts dans les biblioth\u00e8ques node-netmask (JavaScript, CVE-2021-28918, CVE-2021-29418), private-ip (JavaScript, CVE-2020-28360), ipaddress (Python, CVE-2021-29921), Data::Validate::IP (Perl, CVE-2021-29662) et Net::Netmask (Perl, CVE-2021-29424). <\/p>\n

Conform\u00e9ment \u00e0 la sp\u00e9cification, les valeurs de cha\u00eene adresses IP<\/a>, qui commencent par un z\u00e9ro, doivent \u00eatre interpr\u00e9t\u00e9s comme des nombres octaux, mais de nombreuses biblioth\u00e8ques ne tiennent pas compte de cette particularit\u00e9 et se contentent d'ignorer le z\u00e9ro, traitant la valeur comme un nombre d\u00e9cimal. Par exemple, le nombre 0177 en base octale est \u00e9gal \u00e0 127 en d\u00e9cimal. Un attaquant peut demander une ressource en indiquant la valeur \u00ab 0177.0.0.1 \u00bb, qui correspond en d\u00e9cimal \u00e0 \u00ab 127.0.0.1 \u00bb. En cas d'utilisation d'une biblioth\u00e8que probl\u00e9matique, l'application ne d\u00e9terminera pas l'entr\u00e9e de l'adresse 0177.0.0.1 dans le sous-r\u00e9seau 127.0.0.1\/8, mais en r\u00e9alit\u00e9, lors de l'envoi de la requ\u00eate, elle pourra acc\u00e9der \u00e0 l'adresse \u00ab 0177.0.0.1 \u00bb, que les fonctions r\u00e9seau traiteront comme 127.0.0.1. De la m\u00eame mani\u00e8re, il est possible de tromper la v\u00e9rification des adresses intranet en indiquant des valeurs telles que \u00ab 012.0.0.1 \u00bb (\u00e9quivalent \u00e0 \u00ab 10.0.0.1 \u00bb). <\/p>\n

En Rust, le probl\u00e8me concerne la biblioth\u00e8que standard \u00ab std::net \u00bb (CVE-2021-29922). Le parseur d'adresses IP de cette biblioth\u00e8que supprimait le z\u00e9ro pr\u00e9c\u00e9dant les valeurs dans l'adresse, mais seulement si pas plus de trois chiffres \u00e9taient sp\u00e9cifi\u00e9s, par exemple, \u00ab 0177.0.0.1 \u00bb sera consid\u00e9r\u00e9 comme une valeur invalide, tandis qu'une r\u00e9ponse incorrecte sera renvoy\u00e9e pour 010.8.8.8 et 127.0.026.1. Les applications utilisant std::net::IpAddr pour analyser des adresses fournies par l'utilisateur sont potentiellement vuln\u00e9rables aux attaques SSRF (Server-side request forgery), RFI (Remote File Inclusion) et LFI (Local File Inclusion). La vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans la branche Rust 1.53.0.

\"Une<\/center> <\/p>\n

Dans le langage Go, le probl\u00e8me concerne la biblioth\u00e8que standard \u00ab net \u00bb (CVE-2021-29923). La fonction int\u00e9gr\u00e9e net.ParseCIDR omet les z\u00e9ros avant les nombres octaux, au lieu de les traiter. Par exemple, un attaquant peut transmettre la valeur 00000177.0.0.1, qui lors de la v\u00e9rification dans la fonction net.ParseCIDR(00000177.0.0.1\/24) sera analys\u00e9e comme 177.0.0.1\/24, et non 127.0.0.1\/24. Le probl\u00e8me se manifeste \u00e9galement sur la plateforme Kubernetes. La vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans la version Go 1.16.3 et dans la version b\u00eata 1.17.

\"Une<\/center>
\r\n \"Lire\r\n
<\/div>\r\n <\/div><\/center>
\n
Source : opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441 \u0432\u043e\u0441\u044c\u043c\u0438\u0440\u0438\u0447\u043d\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0434\u0440\u0435\u0441\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0430\u0434\u0440\u0435\u0441\u0430\u043c loopback-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 (127.x.x.x) \u0438\u043b\u0438 \u0438\u043d\u0442\u0440\u0430\u043d\u0435\u0442-\u043f\u043e\u0434\u0441\u0435\u0442\u044f\u043c \u043f\u0440\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0430\u0442\u0430\u043a SSRF (Server-side request forgery). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0446\u0438\u043a\u043b \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 node-netmask […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100946,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100945","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vuln\u00e9rabilit\u00e9 dans les biblioth\u00e8ques r\u00e9seau des langages Rust et Go, permettant de contourner la v\u00e9rification des adresses IP | ProHoster","description":"Des vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 identifi\u00e9es dans les biblioth\u00e8ques standard des langages Rust et Go, li\u00e9es \u00e0 un traitement incorrect des adresses IP contenant des chiffres octaux dans les fonctions d'analyse d'adresse.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 | ProHoster","og:description":"\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441 \u0432\u043e\u0441\u044c\u043c\u0438\u0440\u0438\u0447\u043d\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0434\u0440\u0435\u0441\u0430.","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-08-08T14:22:47+00:00","article:modified_time":"2021-08-08T14:22:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100945","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-08-08 15:21:11","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/100945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=100945"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/100945\/revisions"}],"predecessor-version":[{"id":158030,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/100945\/revisions\/158030"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/100946"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=100945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=100945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=100945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}