{"id":163792,"date":"2026-03-10T23:11:57","date_gmt":"2026-03-10T21:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy"},"modified":"2026-03-10T23:11:57","modified_gmt":"2026-03-10T21:11:59","slug":"uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","title":{"rendered":"Ranjivosti u projektu Pingora koje omogu\u0107uju infiltraciju stranih zahtjeva","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Tvrtka Cloudflare objavila je otklanjanje tri ranjivosti u okviru Pingora, od kojih su dvije klasificirane kao kriti\u010dne (9.3 od 10). Okvir Pingora napisan je na jeziku Rust i namijenjen je razvoju sigurnih, visokih performansi mre\u017enih usluga. Proxy izgra\u0111en pomo\u0107u Pingora koristi se u mre\u017ei za isporuku sadr\u017eaja Cloudflare i obra\u0111uje vi\u0161e od 40 milijuna zahtjeva u sekundi. Ranjivosti su otklonjene u izdanju Pingora 0.8.0. <\/p>\n

Dvije najopasnije ranjivosti omogu\u0107uju provo\u0111enje napada tipa \u201eHTTP Request Smuggling\u201d, koji omogu\u0107uju zaobila\u017eenje sustava kontrole pristupa i uba\u010divanje u sadr\u017eaj zahtjeva drugih korisnika, koji se obra\u0111uju u istom toku izme\u0111u frontenda i backend-a (na primjer, za umetanje zlonamjernog JavaScript koda u sesiju drugog korisnika na stranici). Problemi su otkriveni od strane sudionika programa Bug Bounty, koji uklju\u010duje isplatu nagrade za otkrivanje ranjivosti. <\/p>\n

U shemi s pristupom backend-u putem povratnog proxyja, zahtjeve klijenata prihva\u0107a dodatna komponenta koja uspostavlja dugotrajnu TCP vezu s backend-om, koji izravno obra\u0111uje zahtjeve. Kroz ovu zajedni\u010dku vezu obi\u010dno se prenose zahtjevi razli\u010ditih korisnika, koji slijede jedan za drugim uz razdvajanje sredstvima HTTP protokola. Napadi tipa HTTP Request Smuggling nastaju zbog razli\u010ditog tuma\u010denja HTTP zaglavlja i specifikacija HTTP protokola na frontendu i backend-u, na primjer, kada frontend koristi zaglavlje \u201eContent-Length\u201d za odre\u0111ivanje veli\u010dine zahtjeva, a backend \u201eTransfer-Encoding: chunked.\u201d <\/p>\n

Prva ranjivost CVE-2026-2835 prisutna je u kodu za analizu zahtjeva HTTP\/1.0 i uzrokovana je neispravnim obra\u0111ivanjem zaglavlja \u201eTransfer-Encoding\u201d s vi\u0161e vrijednosti, kao i kori\u0161tenjem zatvaranja veze kao oznake kraja tijela zahtjeva (close-delimited). Pingora je provjeravao samo varijantu \u201eTransfer-Encoding: chunked\u201d i ignorirao ovo zaglavlje ako je imalo vi\u0161e vrijednosti. U ovoj situaciji, Pingora nije uzimao u obzir veli\u010dinu u zaglavlju \u201eContent-Length\u201d, ve\u0107 je smatrao tijelom zahtjeva sve podatke primljene do zatvaranja veze. <\/p>\n

Kroz navo\u0111enje vi\u0161e vrijednosti u zaglavlju \u201eTransfer-Encoding\u201d, napada\u010d je mogao stvoriti uvjete pod kojima se na backend preusmjeravao zahtjev \u010dija stvarna veli\u010dina nije odgovarala veli\u010dini chunked-lan\u010dane koja je izra\u010dunata na temelju zaglavlja \u201eTransfer-Encoding\u201d. Pingora je preusmjeravao sve primljene podatke kao jedan zahtjev, a backend, kao \u0161to je Node.js, izra\u010dunavao je zahtjev na temelju \u201eTransfer-Encoding: chunked\u201d i preostali ostatak obra\u0111ivao kao po\u010detak drugog zahtjeva. GET \/ HTTP\/1.0 Host: example.com Connection: keep-alive Transfer-Encoding: identity, chunked Content-Length: 29 0 GET \/admin HTTP\/1.1 X:

\"Ranjivosti<\/center> <\/p>\n

Druga ranjivost CVE-2026-2833 uzrokovana je nepravilnim rukovanjem HTTP-headerom 'Upgrade' u HTTP\/1.1 zahtjevima. Kada je header 'Upgrade' prisutan u zahtjevu, proxy je odmah proslijedio backendu i ostale podatke zahtjeva koji slijede nakon headera 'Upgrade', ne \u010dekaju\u0107i od backenda odgovor s kodom 101 (Switching Protocols). Zbog toga je do\u0161lo do poreme\u0107aja u sinkronizaciji toka izme\u0111u proxy-a i backenda, a backend je tretirao podatke poslane nakon headera 'Upgrade' kao zaseban zahtjev, te je vra\u0107ao rezultat tog zahtjeva u odgovoru na slijede\u0107i zahtjev drugog korisnika. GET \/ HTTP\/1.1 Host: example.com Upgrade: foo GET \/admin HTTP\/1.1 Host: example.com

\"Ranjivosti<\/center>
\"Ranjivosti<\/center> <\/p>\n

Problemi se javljaju pri kori\u0161tenju Pingore u obliku obrnutog proxyja (ingress proxy), koji prenosi zahtjeve korisnika prema backendovima koriste\u0107i protokole HTTP\/1.0 ili HTTP\/1.1. Konfiguracija Pingore u mre\u017ei dostave sadr\u017eaja Cloudflare nije dopu\u0161tala iskori\u0161tavanje ranjivosti, jer Pingora u CDN-u ne koristi se kao ingress-proxy, proslje\u0111uje zahtjeve samo koriste\u0107i protokol HTTP\/1.1, blokira zahtjeve s nepravilnim vrijednostima Content-Length, proslijedjuje samo jednu vrijednost headera 'Transfer-Encoding: chunked' i dodaje dodatni header 'Connection: close' u zahtjeve sa headerom 'Upgrade:', koji ne dopu\u0161ta slanje dodatnih zahtjeva u istom konekciji. <\/p>\n

Tre\u0107a ranjivost CVE-2026-2836 (stepen opasnosti 8.4 od 10) dovodi do trovanja cache-a (cache poisoning) zbog generiranja klju\u010da za pohranu podataka u cache-u (CacheKey) isklju\u010divo na osnovu putanje iz URI, ignoriraju\u0107i sadr\u017eaj headera 'Host'. Ova nedostatka dovodi do formiranja identi\u010dnih klju\u010deva za ke\u0161iranje za iste HTTP-putanje prema razli\u010ditim hostovima. Ranjivost se mo\u017ee iskoristiti za zamjenu sadr\u017eaja cache-a prilikom kori\u0161tenja na\u010dina ke\u0161iranja za vi\u0161e hostova. U Pingori, ke\u0161iranje je eksperimentalna funkcija, koja se ne preporu\u010duje za radna implementacija.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Pingora, \u0434\u0432\u0443\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10). \u0424\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a Pingora \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432. \u041f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Pingora \u043f\u0440\u043e\u043a\u0441\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Cloudflare \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 40 \u043c\u043b\u043d \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432 \u0441\u0435\u043a\u0443\u043d\u0434\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":163793,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-163792","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranjivosti u projektu Pingora koje omogu\u0107avaju upad u sporedne zahteve | ProHoster","description":"Tvrtka Cloudflare je objavila da je otklonila tri ranjivosti u okviru Pingora, od kojih su dve kategorizovane kao kriti\u010dne (9.3 od 10).","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0435 Pingora, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u043a\u043b\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Pingora, \u0434\u0432\u0443\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10).","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-10T21:11:59+00:00","article:modified_time":"2026-03-10T21:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/163792","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=163792"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/163792\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media\/163793"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=163792"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=163792"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=163792"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}