{"id":156092,"date":"2026-02-01T11:11:55","date_gmt":"2026-02-01T09:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone"},"modified":"2026-02-01T11:11:55","modified_gmt":"2026-02-01T09:11:55","slug":"atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","title":{"rendered":"A t\u00e1mad\u00f3knak siker\u00fclt \u00e9szrev\u00e9tlen\u00fcl k\u00e1rt\u00e9kony k\u00f3dot hozz\u00e1adniuk a Plone t\u00e1rol\u00f3j\u00e1hoz","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Plone, a Python \u00e9s JavaScript\/NodeJS alap\u00fa ny\u00edlt forr\u00e1sk\u00f3d\u00fa tartalomkezel\u0151 rendszer fejleszt\u0151i bejelentett\u00e9k, hogy egy incidens k\u00f6vetkezt\u00e9ben egy rosszindulat\u00fa k\u00f3d ker\u00fclt a projekt git-repozit\u00f3rium\u00e1ba a GitHub-on. A rep\u00f3ban eredetileg h\u00e1rom, janu\u00e1r 7-\u00e9n keletkezett m\u00f3dos\u00edt\u00e1st azonos\u00edtottak (1, 2, 3), amelyek rosszindulat\u00fa k\u00f3dot adtak hozz\u00e1 a projekt JavaScript f\u00e1jljaihoz (1, 2, 3). Az incidens vizsg\u00e1lata meg\u00e1llap\u00edtotta, hogy a rosszindulat\u00fa k\u00f3d integr\u00e1l\u00e1s\u00e1ra az\u00e9rt ker\u00fclt sor, mert az egyik fejleszt\u0151 fi\u00f3kj\u00e1t kompromitt\u00e1lt\u00e1k, \u00e9s a hozz\u00e1f\u00e9r\u00e9si tokenj\u00e9t a t\u00e1mad\u00f3k megszerezt\u00e9k, miut\u00e1n rosszindulat\u00fa szoftvert ind\u00edtottak el a rendszer\u00e9ben. <\/p>\n

Janu\u00e1r 14-\u00e9n a kompromitt\u00e1lt fi\u00f3kot letiltott\u00e1k, \u00e9s a projekt fejleszt\u0151inek azt javasolt\u00e1k, hogy elemezz\u00e9k a janu\u00e1r 1. \u00e9s 14. k\u00f6z\u00f6tti commiteket. Janu\u00e1r 27-\u00e9n kider\u00fclt, hogy a megfigyelt commitok nem korl\u00e1toz\u00f3dtak, \u00e9s a t\u00e1mad\u00e1s \u00f6t repozit\u00f3riumot \u00e9rintett (plone\/volto, plone\/mockup, plone\/plone.app.mosaic, plone\/critical-css-cli, plone\/plonetheme.barceloneta), amelyekbe rosszindulat\u00fa k\u00f3dot integr\u00e1ltak \u00e9szrev\u00e9tlen\u00fcl. A plone.app.mosaic repozit\u00f3rium eset\u00e9ben a t\u00e1mad\u00f3knak siker\u00fclt a master \u00e1gat \u00e1tkonfigur\u00e1lniuk. A t\u00e1mad\u00e1st k\u00e9t h\u00f3nappal a fejleszt\u0151 hozz\u00e1f\u00e9r\u00e9si tokenj\u00e9nek megszerz\u00e9se ut\u00e1n hajtott\u00e1k v\u00e9gre. <\/p>\n

A v\u00e1ltoztat\u00e1sok integr\u00e1l\u00e1s\u00e1hoz a szok\u00e1sos elk\u00f6telez\u0151d\u00e9s helyett a t\u00e1mad\u00f3k a \u201eforce push\u201d m\u0171veletet haszn\u00e1lt\u00e1k (git push a \u201e--force\u201d lehet\u0151s\u00e9ggel), amely lehet\u0151v\u00e9 teszi, hogy a branchet k\u00e9nyszer\u00edtve fel\u00fcl\u00edrj\u00e1k a k\u00fcls\u0151 t\u00e1rol\u00f3ban a saj\u00e1t tartalmukkal, ezzel pedig \u00e1tkonfigur\u00e1lj\u00e1k a v\u00e1ltoz\u00e1sok t\u00f6rt\u00e9net\u00e9t (a csere ut\u00e1n a t\u00e1mad\u00f3 \u00e1ltal felt\u00f6lt\u00f6tt branche t\u00f6rt\u00e9nete l\u00e1that\u00f3). A j\u00f6v\u0151beni ilyen t\u00edpus\u00fa valamif\u00e9le helyettes\u00edt\u00e9s megakad\u00e1lyoz\u00e1sa \u00e9rdek\u00e9ben a Plone fejleszt\u0151i olyan szab\u00e1lyokat vezettek be a GitHubon, amelyek blokkolj\u00e1k a \u201eforce push\u201d m\u0171veleteket a f\u0151 branchekre \u00e9s c\u00edmk\u00e9kre. <\/p>\n

A plone.app.mosaic t\u00e1rol\u00f3ban a kompromitt\u00e1l\u00e1s nehezen \u00e9szlelhet\u0151s\u00e9ge \u00e9rdek\u00e9ben a t\u00e1mad\u00f3k egy \u00e1lc\u00e1zott commitot helyeztek el a master branchen, amelynek hamis id\u0151pontja volt - december 18., felt\u00e9telezve, hogy a k\u00e1rtev\u0151 k\u00f3d keres\u00e9s\u00e9nek ter\u00fclete a t\u00e1rol\u00f3ban t\u00f6rt\u00e9n\u0151 els\u0151 aktivit\u00e1suk ut\u00e1ni v\u00e1ltoz\u00e1sokra \u00f6sszpontosul. A k\u00e1rtev\u0151 v\u00e1ltoztat\u00e1st az \u00e1lc\u00e1zott commitban \u00faj tesztkiad\u00e1s fejleszt\u00e9s\u00e9nek kezdetek\u00e9nt mutatt\u00e1k be, de a metadat\u00e1ban a verzi\u00f3sz\u00e1m (4.0.0a1-r\u0151l 4.0.0a2.dev0-ra) mellett a build sor\u00e1n h\u00edvott javascript-f\u00e1jlba, a prettier.config.js-be k\u00e1ros k\u00f3d ker\u00fclt beilleszt\u00e9sre. A termin\u00e1lban t\u00f6rt\u00e9nt v\u00e1ltoztat\u00e1sokn\u00e1l a k\u00f3d egy sorba lett be\u00e1gyazva a legit\u00edm m\u0171velettel, \u00e9s a l\u00e1that\u00f3 ter\u00fcletr\u0151l elmozd\u00edtva, sz\u00f3k\u00f6z\u00f6k felhaszn\u00e1l\u00e1s\u00e1val. A GitHub fel\u00fclet\u00e9n ez a k\u00f3d alapesetben szint\u00e9n nem volt l\u00e1that\u00f3, \u00e9s a \u201eLoad Diff\u201d gombra kellett kattintani a megjelen\u00edt\u00e9s\u00e9hez.

\"A<\/center> <\/p>\n

The attack targeted developers of the project more than users. The malicious changes were not included in the release. The malicious code was activated during the build, downloaded exploits for privilege escalation, configured auto-start by calling its processes from startup scripts, and allowed for remote management. szerverrel<\/a>In addition, the installed malicious component sought and sent confidential data such as access tokens, browser profiles, and cryptocurrency wallet keys.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Plone, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Python \u0438 JavaScript\/NodeJS, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 GitHub \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0438\u0445\u0441\u044f 7 \u044f\u043d\u0432\u0430\u0440\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f (1, 2, 3), \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 JavaScript-\u0444\u0430\u0439\u043b\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 (1, 2, 3). \u0420\u0430\u0437\u0431\u043e\u0440 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":156093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-156092","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47The attackers managed to add unnoticed malicious code to the Plone repository | ProHoster","description":"Developers of the open content management system Plone, written in Python and JavaScript\/NodeJS, announced an incident that resulted in malicious code being added to the project's git repository on GitHub.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Plone | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Plone, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Python \u0438 JavaScript\/NodeJS, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 GitHub \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-02-01T09:11:55+00:00","article:modified_time":"2026-02-01T09:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"156092","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:49:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-01 09:11:56","updated":"2026-02-09 21:49:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/156092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=156092"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/156092\/revisions"}],"predecessor-version":[{"id":160399,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/156092\/revisions\/160399"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/156093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=156092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=156092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=156092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}