{"id":100784,"date":"2021-07-17T22:22:35","date_gmt":"2021-07-17T20:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare"},"modified":"2021-07-17T22:22:35","modified_gmt":"2021-07-17T20:22:35","slug":"uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","title":{"rendered":"A biztons\u00e1gi r\u00e9s a cdnjs-ben, amely lehet\u0151v\u00e9 tette a k\u00f3d v\u00e9grehajt\u00e1s\u00e1t a Cloudflare szerverein","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Cloudflare \u00e1ltal biztos\u00edtott cdnjs tartalomeloszt\u00f3 h\u00e1l\u00f3zat\u00e1ban, amely a JavaScript k\u00f6nyvt\u00e1rak gyorsabb sz\u00e1ll\u00edt\u00e1s\u00e1ra k\u00e9sz\u00fclt, kritikus biztons\u00e1gi r\u00e9s ker\u00fclt felfedez\u00e9sre, amely lehet\u0151v\u00e9 teszi tetsz\u0151leges k\u00f3d v\u00e9grehajt\u00e1s\u00e1t a CDN szerverein. A probl\u00e9ma s\u00falyoss\u00e1g\u00e1t fokozza, hogy a szolg\u00e1ltat\u00e1st az interneten tal\u00e1lhat\u00f3 webhelyek k\u00f6r\u00fclbel\u00fcl 12,7%-a haszn\u00e1lja a JavaScript k\u00f6nyvt\u00e1rak bet\u00f6lt\u00e9s\u00e9re, \u00e9s az infrastrukt\u00fara kompromitt\u00e1l\u00e1sa lehet\u0151v\u00e9 teszi a k\u00f6nyvt\u00e1rak helyettes\u00edt\u00e9s\u00e9t b\u00e1rmelyik ilyen webhelyen. <\/p>\n

A cdnjs szolg\u00e1ltat\u00e1s lehet\u0151v\u00e9 teszi a csomagok let\u00f6lt\u00e9s\u00e9t Git-b\u0151l vagy az NPM t\u00e1rol\u00f3b\u00f3l, majd ingyen hozz\u00e1f\u00e9r\u00e9st biztos\u00edt b\u00e1rmely weboldal sz\u00e1m\u00e1ra a Cloudflare tartalomel\u00e9r\u00e9si h\u00e1l\u00f3zat\u00e1hoz, hogy felgyors\u00edtsa a JavaScript k\u00f6nyvt\u00e1rak bet\u00f6lt\u00e9s\u00e9t. A cdnjs komponenseinek k\u00f3dj\u00e1nak GitHub-on v\u00e9gzett vizsg\u00e1lata sor\u00e1n meg\u00e1llap\u00edt\u00e1st nyert, hogy az NPM csomagok kicsomagol\u00e1s\u00e1hoz a tgz arch\u00edvumokban a Go nyelvben \u00edrt archive\/tar be\u00e9p\u00edtett modult haszn\u00e1lj\u00e1k, amely a f\u00e1jlok list\u00e1j\u00e1t v\u00e1ltozatlan form\u00e1ban adja vissza, an\u00e9lk\u00fcl, hogy normaliz\u00e1ln\u00e1 az \u00fatvonalakat. Amikor a szkript az adott lista alapj\u00e1n kicsomagolja a tartalmat, a .. \/ .. \/ .. \/ .. \/ .. \/ .. \/ .. \/ tmp \/ test t\u00edpus\u00fa f\u00e1jlok megl\u00e9te az arch\u00edvumban v\u00e9letlenszer\u0171 f\u00e1jlok fel\u00fcl\u00edr\u00e1s\u00e1hoz vezethet a rendszerben, amennyiben a hozz\u00e1f\u00e9r\u00e9si jogok lehet\u0151v\u00e9 teszik. <\/p>\n

Felt\u00e9telezt\u00e9k, hogy a t\u00e1mad\u00f3 k\u00e9relmezheti a saj\u00e1t k\u00f6nyvt\u00e1r\u00e1nak hozz\u00e1ad\u00e1s\u00e1t a cdnjs-hez, \u00e9s speci\u00e1lisan elk\u00e9sz\u00edtett arch\u00edvumot t\u00f6lthet fel az NPM t\u00e1rol\u00f3ba, amely f\u00e1jlokat tartalmaz .. \/ karakterekkel az \u00fatvonalban. A cdnjs szerverein id\u0151szakonk\u00e9nt v\u00e9grehajtj\u00e1k az autoupdate m\u0171veletet, ahol a feldolgoz\u00f3 \u00faj verzi\u00f3kat t\u00f6lt le a javasolt k\u00f6nyvt\u00e1rb\u00f3l, \u00e9s kicsomagolja a tartalmat. Az .. \/ \u00fatvonal\u00fa f\u00e1jlok seg\u00edts\u00e9g\u00e9vel a t\u00e1mad\u00f3 el\u00e9rheti a szolg\u00e1ltat\u00e1s szkriptjeinek fel\u00fcl\u00edr\u00e1s\u00e1t \u00e9s a saj\u00e1t k\u00f3dja v\u00e9grehajt\u00e1s\u00e1t. szerveren<\/a> amelyen a kib\u0151v\u00edt\u00e9s t\u00f6rt\u00e9nt. <\/p>\n

A Git-b\u0151l t\u00f6rt\u00e9n\u0151 friss\u00edt\u00e9sek let\u00f6lt\u00e9sekor kider\u00fclt, hogy a friss\u00edt\u00e9seket kezel\u0151 feldolgoz\u00f3 nem vette figyelembe a szimbolikus linkeket a f\u00e1jlok Git-b\u0151l t\u00f6rt\u00e9n\u0151 m\u00e1sol\u00e1sakor. Ez a jelens\u00e9g lehet\u0151v\u00e9 tette b\u00e1rmilyen f\u00e1jl olvas\u00e1s\u00e1t a a szerver<\/a> szimbolikus linkek Git-be t\u00f6rt\u00e9n\u0151 hozz\u00e1ad\u00e1s\u00e1val. <\/p>\n

A cdnjs hack demonstration experiment for claiming a HackerOne bounty was initiated by testing a hypothesis related to file reading. A symbolic link test.js was added to the Git repository of the JavaScript library served via CDN, pointing to the file \/proc\/self\/maps. After a new version of the library was published, the update handler processed this repository and published the specified file on cdnjs (test.js was created as a symbolic link and when this file was requested, the content of \/proc\/self\/maps was returned). <\/p>\n

By substituting the symbolic link to the file \/proc\/self\/environ, the researcher noted that the returned data contained the values of the environment variables GITHUB_REPO_API_KEY and WORKERS_KV_API_TOKEN. The first variable stored the API key for write access to the repository robocdnjs on GitHub. The second variable stored the KV storage token in cdnjs. By utilizing this information, the attacker could make changes to cdnjs and completely compromise the infrastructure.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cloudflare \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 cdnjs, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0439 \u0434\u043b\u044f \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 CDN. \u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0443\u0433\u0443\u0431\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u043c, \u0447\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c \u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043e\u043a\u043e\u043b\u043e 12.7% \u0432\u0441\u0435\u0445 \u0441\u0430\u0439\u0442\u043e\u0432 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u043e\u0442\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u043b\u044e\u0431\u044b\u043c \u0438\u0437 \u044d\u0442\u0438\u0445 \u0441\u0430\u0439\u0442\u043e\u0432. \u0421\u0435\u0440\u0432\u0438\u0441 cdnjs \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100784","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerability in cdnjs that allowed code execution on Cloudflare servers | ProHoster","description":"A critical vulnerability has been identified in the cdnjs content delivery network provided by Cloudflare, designed to accelerate the delivery of JavaScript libraries, allowing arbitrary code execution on the servers.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 cdnjs, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Cloudflare | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cloudflare \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 cdnjs, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0439 \u0434\u043b\u044f \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-17T20:22:35+00:00","article:modified_time":"2021-07-17T20:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100784","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-17 22:01:30","updated":"2026-02-22 15:30:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=100784"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100784\/revisions"}],"predecessor-version":[{"id":162261,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/100784\/revisions\/162261"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=100784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=100784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=100784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}