{"id":33388,"date":"2019-10-31T21:52:18","date_gmt":"2019-10-31T18:52:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3\/"},"modified":"2019-10-31T21:52:18","modified_gmt":"2019-10-31T18:52:18","slug":"uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3","title":{"rendered":"A PharStreamWrapper library vulnerability affecting Drupal, Joomla, and Typo3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

In the library PharStreamWrapper<\/a><\/noindex>, which provides handlers for protection against conducting<\/a><\/noindex> attacks<\/a><\/noindex> a f\u00e1jlok «Phar» form\u00e1tum\u00e1nak behelyettes\u00edt\u00e9s\u00e9n kereszt\u00fcl, identified<\/a><\/noindex> vulnerability<\/a><\/noindex> (CVE-2019-11831<\/a><\/noindex>), amely lehet\u0151v\u00e9 teszi a k\u00f3d deszerializ\u00e1l\u00e1s elleni v\u00e9delem megker\u00fcl\u00e9s\u00e9t az «..» karakterek behelyettes\u00edt\u00e9s\u00e9vel az \u00fatvonalban. P\u00e9ld\u00e1ul a t\u00e1mad\u00f3 t\u00e1mad\u00e1sra haszn\u00e1lhat egy URL-t, mint «phar:\/\/path\/bad.phar\/..\/good.phar», \u00e9s a k\u00f6nyvt\u00e1r a base n\u00e9v ellen\u0151rz\u00e9sekor «\/path\/good.phar» \u00e9rt\u00e9ket ad, b\u00e1r a hasonl\u00f3 \u00fatvonal tov\u00e1bbi feldolgoz\u00e1sa sor\u00e1n a «\/path\/bad.phar» f\u00e1jlt fogja haszn\u00e1lni.<\/p>\n

The library was developed by the creators of the TYPO3 CMS, but it is also used in Drupal and Joomla projects, making them vulnerable as well. The issue has been resolved in releases PharStreamWrapper 2.1.1 and 3.1.1<\/a><\/noindex>. The Drupal project addressed the issue in updates 7.67, 8.6.16, and 8.7.1. In Joomla, the problem appears from version 3.9.3 and was resolved in release 3.9.6. To address the issue in TYPO3, the PharStreamWrapper library must be updated.<\/p>\n

Gyakorlati szempontb\u00f3l a PharStreamWapper s\u00e9r\u00fcl\u00e9kenys\u00e9ge lehet\u0151v\u00e9 teszi a Drupal Core felhaszn\u00e1l\u00f3j\u00e1nak, aki adminisztr\u00e1tori jogosults\u00e1gokkal rendelkezik a t\u00e9m\u00e1k kezel\u00e9s\u00e9ben (‘Administer theme’), hogy k\u00e1ros phar-f\u00e1jlt t\u00f6lts\u00f6n fel, \u00e9s v\u00e9grehajtsa benne elhelyezett PHP-k\u00f3dot egy leg\u00e1lis phar-arch\u00edvum l\u00e1tszat\u00e1ban. Ne felejts\u00fck el, hogy a «Phar deserialization» t\u00e1mad\u00e1s l\u00e9nyege, hogy a felt\u00f6lt\u00f6tt f\u00e1jlok ellen\u0151rz\u00e9sekor a PHP file_exists() f\u00fcggv\u00e9ny automatikusan deszerializ\u00e1lja a Phar (PHP Archive) f\u00e1jlok metaadatait a «phar:\/\/» kezdet\u0171 \u00fatvonalak feldolgoz\u00e1sakor. A phar-f\u00e1jl k\u00e9pk\u00e9nt val\u00f3 \u00e1tvitele lehets\u00e9ges, mivel a file_exists() f\u00fcggv\u00e9ny a MIME-t\u00edpust a tartalom alapj\u00e1n hat\u00e1rozza meg, nem a kiterjeszt\u00e9s alapj\u00e1n.<\/p>\n

<\/a><\/noindex><\/p>\n

Forr\u00e1s: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 PharStreamWrapper, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 «Phar», \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-11831), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u043e\u0442 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 «..» \u0432 \u043f\u0443\u0442\u0438. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 URL \u0432\u0438\u0434\u0430 «phar:\/\/\/path\/bad.phar\/..\/good.phar» \u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u0432\u044b\u0434\u0435\u043b\u0438\u0442 \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0431\u0430\u0437\u043e\u0432\u043e\u0435 \u0438\u043c\u044f «\/path\/good.phar», \u0445\u043e\u0442\u044f \u043f\u0440\u0438 \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u0431\u0443\u0434\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-33388","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A vulnerability in the PharStreamWrapper library affecting Drupal, Joomla, and Typo3 | ProHoster","description":"In the PharStreamWrapper library, which provides handlers for protection against","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 PharStreamWrapper, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f Drupal, Joomla \u0438 Typo3 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 PharStreamWrapper, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:52:18+00:00","article:modified_time":"2019-10-31T18:52:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33388","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 15:01:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:41:46","updated":"2026-01-21 15:01:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/33388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=33388"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/33388\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=33388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=33388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=33388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}