Hauv tsev qiv ntawv , muab cov neeg tuav pov hwm los tiv thaiv los ntawm kev hloov cov ntaub ntawv hauv hom ntawv "Phar", (), uas tso cai rau kev hla dhau kev tiv thaiv code deserialization los ntawm kev hloov cov cim ".." hauv txoj kev. Piv txwv li, tus neeg tawm tsam tuaj yeem siv URL zoo li "phar:///path/bad.phar/../good.phar" rau kev tawm tsam, thiab lub tsev qiv ntawv yuav xaiv lub npe pib "/path/good.phar" thaum lub sijhawm txheeb xyuas, txawm hais tias kev ua tiav ntxiv ntawm txoj kev zoo li no yuav siv cov ntaub ntawv "/path/bad.phar."
Lub tsev qiv ntawv tau tsim los ntawm cov neeg tsim CMS TYPO3, tab sis kuj siv rau hauv cov haujlwm Drupal ΠΈ Joomla, uas ua rau lawv kuj tsis muaj zog. Qhov teeb meem tau kho lawm hauv cov ntawv tso tawm . Txoj Haujlwm Drupal Kho qhov teeb meem hauv kev hloov tshiab 7.67, 8.6.16 thiab 8.7.1. Joomla Qhov teeb meem no tau muaj txij li version 3.9.3 thiab tau kho hauv version 3.9.6. Txhawm rau kho qhov teeb meem hauv TYPO3, koj yuav tsum hloov kho lub tsev qiv ntawv PharStreamWapper.
Los ntawm qhov kev xav ua tau tiag tiag, qhov tsis muaj zog hauv PharStreamWapper tso cai rau tus neeg siv Drupal Core, nrog rau 'Administer theme' privileges, upload ib cov ntaub ntawv phar phem thiab ua raws li PHP code uas muaj nyob hauv, zais ua ib qho archive phar raug cai. Ua ib qho kev ceeb toom, qhov kev tawm tsam "Phar deserialization" ua haujlwm los ntawm kev deserializing metadata los ntawm cov ntaub ntawv Phar (PHP Archive) thaum kuaj xyuas cov ntaub ntawv pab uas tau upload rau PHP function file_exists() thaum ua cov paths pib nrog "phar://." Kev hloov cov ntaub ntawv phar ua ib daim duab yog ua tau, vim file_exists() txiav txim siab hom MIME raws li cov ntsiab lus ntawm cov ntaub ntawv, tsis yog nws qhov extension.
Tau qhov twg los: opennet.ru
