{"id":86356,"date":"2020-06-24T13:42:00","date_gmt":"2020-06-24T11:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda"},"modified":"2020-06-24T13:42:00","modified_gmt":"2020-06-24T11:42:00","slug":"uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","title":{"rendered":"Vuln\u00e9rabilit\u00e9 dans le navigateur s\u00e9curis\u00e9 Bitdefender SafePay, entra\u00eenant l'ex\u00e9cution de code","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vladimir Palant, cr\u00e9ateur d'Adblock Plus, des vuln\u00e9rabilit\u00e9s<\/a><\/noindex> CVE-2020-10174<\/a><\/noindex> (CVE-2020-8102<\/a><\/noindex>) dans le navigateur web sp\u00e9cialis\u00e9 bas\u00e9 sur le moteur Chromium Safepay, propos\u00e9 dans le cadre du paquet antivirus Bitdefender Total Security 2020 et visant \u00e0 am\u00e9liorer la s\u00e9curit\u00e9 de l'utilisateur dans le r\u00e9seau mondial (par exemple, une isolation suppl\u00e9mentaire est fournie lors des connexions aux banques et aux syst\u00e8mes de paiement). La vuln\u00e9rabilit\u00e9 permet aux sites ouverts dans le navigateur d'ex\u00e9cuter du code arbitraire au niveau du syst\u00e8me d'exploitation.<\/p>\n

La raison du probl\u00e8me r\u00e9side dans le fait que l'antivirus Bitdefender effectue une interception locale du trafic HTTPS en rempla\u00e7ant le certificat TLS original du site. Un certificat racine suppl\u00e9mentaire est install\u00e9 sur le syst\u00e8me du client, permettant de masquer le fonctionnement du syst\u00e8me d'inspection du trafic utilis\u00e9. L'antivirus s'int\u00e8gre dans le trafic s\u00e9curis\u00e9 et injecte son propre code JavaScript dans certaines pages pour r\u00e9aliser la fonction Safe Search, et en cas de probl\u00e8me avec le certificat de la connexion s\u00e9curis\u00e9e, remplace la page d'erreur affich\u00e9e par la sienne. \u00c9tant donn\u00e9 que la nouvelle page d'erreur est fournie au nom du serveur ouvert, d'autres pages de ce serveur ont un acc\u00e8s complet au contenu ins\u00e9r\u00e9 par Bitdefender.<\/p>\n

Lors de l'ouverture d'un site contr\u00f4l\u00e9 par un attaquant, ce site peut envoyer une requ\u00eate XMLHttpRequest et simuler un probl\u00e8me avec le certificat HTTPS en r\u00e9pondant avec une page d'erreur modifi\u00e9e par Bitdefender. Puisque la page d'erreur est ouverte dans le contexte du domaine de l'attaquant, il peut lire le contenu de la page modifi\u00e9e avec les param\u00e8tres de Bitdefender. La page Bitdefender inclut \u00e9galement une cl\u00e9 de session, permettant d'initier une session de navigateur Safepay via l'API interne de Bitdefender, en sp\u00e9cifiant des drapeaux de ligne de commande arbitraires, et d'ex\u00e9cuter n'importe quelle commande syst\u00e8me en utilisant le drapeau \u00ab --utility-cmd-prefix \u00bb. Exemple d'exploit (param1 et param2 - valeurs obtenues depuis la page d'erreur) :<\/p>\n

var request = new XMLHttpRequest();
\n request.open('POST', Math.random());
\n request.setRequestHeader('Content-type', 'application\/x-www-form-urlencoded');
\n request.setRequestHeader('BDNDSS_B67EA559F21B487F861FDA8A44F01C50', param1);
\n request.setRequestHeader('BDNDCA_BBACF84D61A04F9AA66019A14B035478', param2);
\n request.setRequestHeader('BDNDWB_5056E556833D49C1AF4085CB254FC242', 'obk.run');
\n request.setRequestHeader('BDNDOK_4E961A95B7B44CBCA1907D3D3643370D', location.href);
\n request.send('data:text\/html,nada --utility-cmd-prefix=\\cmd.exe \/k whoami & echo\\');<\/p>\n

\"Vuln\u00e9rabilit\u00e9<\/a><\/noindex><\/center><\/p>\n

Rappelons qu'une \u00e9tude r\u00e9alis\u00e9e en 2017 a montr\u00e9<\/a><\/noindex>, qui a r\u00e9v\u00e9l\u00e9 que 24 des 26 produits antivirus test\u00e9s, inspectant le trafic HTTPS par le biais de substitution de certificats, diminuaient le niveau de s\u00e9curit\u00e9 global des connexions HTTPS.
\nLes ensembles de chiffrement actuels n'\u00e9taient fournis que dans 11 des 26 produits. 5 syst\u00e8mes ne v\u00e9rifiaient pas les certificats (Kaspersky Internet Security 16 Mac, NOD32 AV 9, CYBERsitter, Net Nanny 7 Win, Net Nanny 7 Mac). Les produits Kaspersky Internet Security et Total Security \u00e9taient vuln\u00e9rables aux attaques CRIME<\/a><\/noindex>, tandis que les produits AVG, Bitdefender et Bullguard \u00e9taient \u00e9galement expos\u00e9s aux attaques Logjam<\/a><\/noindex> et POODLE<\/a><\/noindex>. Le produit Dr.Web Antivirus 11 permet de revenir \u00e0 des chiffrements d'exportation non s\u00e9curis\u00e9s (attaque FREAK<\/a><\/noindex>).<\/p>\n

<\/a><\/noindex><\/p>\n

Source : opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u043b\u0430\u0434\u0438\u043c\u0438\u0440 \u041f\u0430\u043b\u0430\u043d\u0442, \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c Adblock Plus, \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8102) \u0432 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0430 \u0434\u0432\u0438\u0436\u043a\u0435 Chromium \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c web-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Safepay, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 Bitdefender Total Security 2020 \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0431\u0430\u043d\u043a\u0430\u043c \u0438 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u043c \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \u0441\u0430\u0439\u0442\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86357,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-86356","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Une vuln\u00e9rabilit\u00e9 dans le navigateur s\u00e9curis\u00e9 Bitdefender SafePay, entra\u00eenant l'ex\u00e9cution de code | ProHoster","description":"Vladimir Palant, cr\u00e9ateur d'Adblock Plus, a identifi\u00e9","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u043c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Bitdefender SafePay, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412\u043b\u0430\u0434\u0438\u043c\u0438\u0440 \u041f\u0430\u043b\u0430\u043d\u0442, \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c Adblock Plus, \u0432\u044b\u044f\u0432\u0438\u043b","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-24T11:42:00+00:00","article:modified_time":"2020-06-24T11:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86356","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:17:32","updated":"2022-09-28 12:42:50","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/86356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=86356"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/86356\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media\/86357"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=86356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=86356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=86356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}