{"id":117354,"date":"2024-07-12T09:43:01","date_gmt":"2024-07-12T07:43:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python"},"modified":"2024-07-12T09:43:01","modified_gmt":"2024-07-12T07:43:01","slug":"utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/utechka-tokena-dlya-polnogo-dostupa-k-github-repozitoriyam-proekta-python","title":{"rendered":"A hozz\u00e1f\u00e9r\u00e9si token sziv\u00e1rg\u00e1sa a Python projekt GitHub-t\u00e1rol\u00f3ihoz","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A JFrog kutat\u00f3i felfedezt\u00e9k, hogy a Docker-k\u00e9pben l\u00e9v\u0151 «cabotage-app» \u00f6sszetev\u0151je egy adminisztr\u00e1tori jogosults\u00e1gokkal rendelkez\u0151 tokent tartalmaz, amely hozz\u00e1f\u00e9r\u00e9st biztos\u00edt a Python, PyPI \u00e9s a Python Software Foundation t\u00e1rol\u00f3ihoz a GitHub-on. A tokent a «__pycache__\/build.cpython-311.pyc» bin\u00e1ris f\u00e1jlban tal\u00e1lt\u00e1k, amelyben a t\u00f6m\u00f6r\u00edtett, el\u0151kompilerelt b\u00e1jtk\u00f3d tal\u00e1lhat\u00f3.
<\/center> <\/p>\n
According to representatives from the PyPI repository, the token was created in 2023 for the developer ewdurbin (Ee Durbin), who serves as the Director of Infrastructure at the Python Software Foundation. The token provided admin access to all repositories and organizations within the project, including all repositories of the organizations pypi, python, psf, and pypa. The problematic Docker image with the token was published in the Docker Hub catalog on March 3, 2023, and was removed on June 11, 2024, meaning it was publicly accessible for 16 months. The token was revoked on June 28. <\/p>\n
\u00c9rdekes m\u00f3don a probl\u00e9m\u00e1s b\u00e1jtk\u00f3dot gener\u00e1l\u00f3 forr\u00e1sk\u00f3dokban nem tal\u00e1lhat\u00f3 eml\u00edt\u00e9s a tokenr\u0151l. A k\u00f3d szerz\u0151je elmondta, hogy a cabotage-app5 eszk\u00f6z fejleszt\u00e9se sor\u00e1n a helyi rendszer\u00e9n a GitHub API-hoz val\u00f3 hozz\u00e1f\u00e9r\u00e9s intenzit\u00e1s\u00e1nak korl\u00e1toz\u00e1saival tal\u00e1lkozott, \u00e9s hogy megker\u00fclje az anonim GitHub h\u00edv\u00e1sokra vonatkoz\u00f3 limiteket, ideiglenesen hozz\u00e1adta a munkahelyi tokenj\u00e9t a k\u00f3dhoz. A k\u00f3d k\u00f6zz\u00e9t\u00e9tele el\u0151tt a tokent elt\u00e1vol\u00edtott\u00e1k, de a fejleszt\u0151 nem vette figyelembe, hogy a token eml\u00edt\u00e9se a b\u00e1jtk\u00f3d el\u0151kompilerelt f\u00e1jlj\u00e1ban elt\u00e1rol\u00f3dott, amely k\u00e9s\u0151bb beker\u00fclt a docker-k\u00e9pbe. def _fetch_github_file( — github_repository=»owner\/repo», ref=»main», access_token=None, filename=»Dockerfile» + github_repository=»owner\/repo», + ref=»main», + access_token=»0d6a9bb5af126f73350a2afc058492765446aaad», + filename=»Dockerfile», ): <\/p>\n
The audit of activity in the repositories on GitHub conducted by Python developers did not reveal any external attempts to access using the exposed token. Given that GitHub has been the primary platform for CPython development since 2017, the token falling into the wrong hands could have led to a complete compromise of the infrastructure used for Python development and the PyPI repository, as well as attempts to integrate backdoors into CPython and the PyPI package manager. <\/p>\n
Az incidens r\u00e1vil\u00e1g\u00edt arra, hogy a sziv\u00e1rg\u00e1sok elemz\u00e9se nemcsak a forr\u00e1sk\u00f3dban, konfigur\u00e1ci\u00f3s f\u00e1jlokban \u00e9s k\u00f6rnyezeti v\u00e1ltoz\u00f3kban fontos, hanem a bin\u00e1ris f\u00e1jlokban is. A Python kontextus\u00e1ban a felhaszn\u00e1l\u00f3knak figyelni\u00fck kell a let\u00f6lt\u00f6tt projektekben tal\u00e1lhat\u00f3 pyc f\u00e1jlokra is, mivel ezek a f\u00e1jlok olyan rejtett m\u00f3dos\u00edt\u00e1sokat tartalmazhatnak, amelyek nem tal\u00e1lhat\u00f3k meg a forr\u00e1sk\u00f3dban. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"A](\"\/wp-content\/uploads\/2024\/07\/995cd4986ccb553d612c78345dfec4ad.png\")
<\/center> <\/p>\n