Hauv lub platform qhib rau kev teeb tsa e-lag luam , uas yuav siv sij hawm txog kev lag luam ntawm cov txheej txheem tsim cov khw muag khoom online, vulnerabilities, kev sib xyaw ua ke uas tso cai rau koj ua kom muaj kev tawm tsam los tua koj cov cai ntawm tus neeg rau zaub mov, tau txais kev tswj hwm tag nrho ntawm lub khw hauv online thiab teeb tsa cov kev them nyiaj rov qab. Vulnerabilities hauv Magento tso tawm 2.3.2, 2.2.9 thiab 2.1.18, uas ua ke kho 75 teeb meem kev nyab xeeb.
Ib qhov teeb meem tso cai rau tus neeg siv tsis raug lees paub kom ua tiav JavaScript (XSS) qhov chaw uas tuaj yeem ua tiav thaum saib cov keeb kwm kev yuav khoom raug tshem tawm hauv admin interface. Lub ntsiab lus ntawm qhov tsis zoo yog lub peev xwm los hla kev ua haujlwm tu cov ntawv siv kev khiav tawmHtmlWithLinks() ua haujlwm thaum ua cov ntawv sau tseg hauv daim ntawv tshem tawm ntawm qhov tshuaj ntsuam xyuas (siv "a href=http://onmouseover=..." tag nested in another tag). Qhov teeb meem tshwm sim nws tus kheej thaum siv lub built-in Authorize.Net module, uas yog siv los txais credit card them.
Txhawm rau kom tau txais kev tswj hwm tag nrho siv JavaScript code nyob rau hauv cov ntsiab lus ntawm kev sib kho tam sim no ntawm tus neeg ua haujlwm hauv khw, qhov muaj qhov tsis zoo thib ob yog siv, uas tso cai rau koj thauj cov ntaub ntawv phar hauv qab daim duab ( "Phar deserialization"). Cov ntaub ntawv Phar tuaj yeem xa tawm los ntawm daim ntawv tso duab tso rau hauv WYSIWYG editor built-in. Tom qab ua tiav kev ua tiav ntawm nws tus lej PHP, tus neeg tawm tsam tuaj yeem hloov pauv cov ntsiab lus them nyiaj lossis cuam tshuam cov neeg siv khoom credit card cov ntaub ntawv.
Qhov zoo siab, cov ntaub ntawv hais txog qhov teeb meem XSS tau xa mus rau Magento cov neeg tsim khoom rov qab rau lub Cuaj Hli 2018, tom qab ntawd ib thaj chaw tau tso tawm thaum kawg ntawm lub Kaum Ib Hlis, uas, raws li nws tau tawm, tshem tawm tsuas yog ib qho ntawm cov xwm txheej tshwj xeeb thiab yooj yim hla. Thaum Lub Ib Hlis, nws tau tshaj tawm ntxiv txog qhov muaj peev xwm rub tawm Phar cov ntaub ntawv raws li kev kos duab ntawm daim duab thiab qhia tias yuav ua li cas sib xyaw ntawm ob qhov tsis zoo tuaj yeem siv los cuam tshuam cov khw muag khoom online. Thaum kawg ntawm lub Peb Hlis hauv Magento 2.3.1,
2.2.8 thiab 2.1.17 kho qhov teeb meem nrog Phar cov ntaub ntawv, tab sis tsis nco qab XSS kho, txawm tias qhov teeb meem daim pib raug kaw. Thaum lub Plaub Hlis, XSS parsing rov pib dua thiab qhov teeb meem raug kho hauv kev tshaj tawm 2.3.2, 2.2.9, thiab 2.1.18.
Nws yuav tsum raug sau tseg tias cov kev tso tawm no kuj txhim kho 75 qhov tsis zoo, 16 ntawm cov uas raug ntsuas raws li qhov tseem ceeb, thiab 20 qhov teeb meem tuaj yeem ua rau PHP code ua tiav lossis SQL hloov pauv. Feem ntau cov teeb meem tseem ceeb tsuas yog ua tau los ntawm tus neeg siv kev lees paub, tab sis raws li qhia saum toj no, kev ua pov thawj tau yooj yim tuaj yeem ua tiav siv XSS qhov tsis zoo, ntawm ntau lub kaum os tau patched hauv cov ntawv sau tseg.
Tau qhov twg los: opennet.ru