{"id":100945,"date":"2021-08-08T16:22:46","date_gmt":"2021-08-08T14:22:47","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov"},"modified":"2021-08-08T16:22:46","modified_gmt":"2021-08-08T14:22:47","slug":"uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","title":{"rendered":"Luka w bibliotekach sieciowych j\u0119zyk\u00f3w Rust i Go, umo\u017cliwiaj\u0105ca obej\u015bcie weryfikacji adres\u00f3w IP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

W standardowych bibliotekach j\u0119zyk\u00f3w Rust i Go zidentyfikowano luki bezpiecze\u0144stwa zwi\u0105zane z nieprawid\u0142owym przetwarzaniem adres\u00f3w IP zawieraj\u0105cych cyfry \u00f3semkowe w funkcjach analizy adres\u00f3w. Luki te umo\u017cliwiaj\u0105 obej\u015bcie kontroli poprawno\u015bci adres\u00f3w w aplikacjach, na przyk\u0142ad w celu skierowania zapyta\u0144 do adres\u00f3w interfejsu loopback (127.x.x.x) lub intranetowych podsieci podczas atak\u00f3w SSRF (Server-side request forgery). Luki te kontynuuj\u0105 cykl problem\u00f3w wcze\u015bniej zidentyfikowanych w bibliotekach node-netmask (JavaScript, CVE-2021-28918, CVE-2021-29418), private-ip (JavaScript, CVE-2020-28360), ipaddress (Python, CVE-2021-29921), Data::Validate::IP (Perl, CVE-2021-29662) oraz Net::Netmask (Perl, CVE-2021-29424). <\/p>\n

Zgodnie ze specyfikacj\u0105 warto\u015bci ci\u0105g\u00f3w adres\u00f3w IP<\/a>, kt\u00f3re zaczynaj\u0105 si\u0119 od zera, powinny by\u0107 interpretowane jako liczby \u00f3semkowe, ale wiele bibliotek tego nie uwzgl\u0119dnia i po prostu odrzuca zero, traktuj\u0105c warto\u015b\u0107 jako liczb\u0119 dziesi\u0119tn\u0105. Na przyk\u0142ad liczba 0177 w systemie \u00f3semkowym odpowiada 127 w dziesi\u0119tnym. Napastnik mo\u017ce za\u017c\u0105da\u0107 zasobu, podaj\u0105c warto\u015b\u0107 «0177.0.0.1», kt\u00f3ra w postaci dziesi\u0119tnej odpowiada «127.0.0.1». W przypadku u\u017cycia problematycznej biblioteki aplikacja nie zidentyfikuje adresu 0177.0.0.1 w podsieci 127.0.0.1\/8, ale faktycznie przy wysy\u0142aniu \u017c\u0105dania mo\u017ce odwo\u0142a\u0107 si\u0119 do adresu «0177.0.0.1», kt\u00f3ry funkcje sieciowe przetworz\u0105 jako 127.0.0.1. Podobnie mo\u017cna oszuka\u0107 weryfikacj\u0119 dost\u0119pu do adres\u00f3w intranetowych, podaj\u0105c warto\u015bci takie jak «012.0.0.1» (odpowiadaj\u0105cy «10.0.0.1»). <\/p>\n

W Rust problem dotyczy\u0142 standardowej biblioteki «std::net» (CVE-2021-29922). Parser adres\u00f3w IP tej biblioteki odrzuca\u0142 zero przed warto\u015bciami w adresie, ale tylko je\u015bli podano nie wi\u0119cej ni\u017c trzy cyfry, na przyk\u0142ad «0177.0.0.1» zostanie uznane za warto\u015b\u0107 niedopuszczaln\u0105, a w odpowiedzi na 010.8.8.8 i 127.0.026.1 zwr\u00f3cony zostanie b\u0142\u0119dny wynik. Aplikacje korzystaj\u0105ce z std::net::IpAddr przy analizie podanych przez u\u017cytkownika adres\u00f3w s\u0105 potencjalnie nara\u017cone na ataki SSRF (Server-side request forgery), RFI (Remote File Inclusion) i LFI (Local File Inclusion). Luka zosta\u0142a usuni\u0119ta w wersji Rust 1.53.0.

\"Luka<\/center> <\/p>\n

W j\u0119zyku Go problem dotyczy standardowej biblioteki «net» (CVE-2021-29923). Wbudowana funkcja net.ParseCIDR pomija zera przed liczbami \u00f3semkowymi, zamiast je przetwarza\u0107. Na przyk\u0142ad napastnik mo\u017ce przekaza\u0107 warto\u015b\u0107 00000177.0.0.1, kt\u00f3ra przy weryfikacji w funkcji net.ParseCIDR(00000177.0.0.1\/24) zostanie zinterpretowana jako 177.0.0.1\/24, a nie 127.0.0.1\/24. Problem ten wyst\u0119puje r\u00f3wnie\u017c na platformie Kubernetes. Luka zosta\u0142a usuni\u0119ta w wersji Go 1.16.3 i wersji beta 1.17.

\"Luka<\/center>
\r\n \"Odtwarzaj\r\n
<\/div>\r\n <\/div><\/center>
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441 \u0432\u043e\u0441\u044c\u043c\u0438\u0440\u0438\u0447\u043d\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0434\u0440\u0435\u0441\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0430\u0434\u0440\u0435\u0441\u0430\u043c loopback-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 (127.x.x.x) \u0438\u043b\u0438 \u0438\u043d\u0442\u0440\u0430\u043d\u0435\u0442-\u043f\u043e\u0434\u0441\u0435\u0442\u044f\u043c \u043f\u0440\u0438 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0438 \u0430\u0442\u0430\u043a SSRF (Server-side request forgery). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442 \u0446\u0438\u043a\u043b \u043f\u0440\u043e\u0431\u043b\u0435\u043c, \u0440\u0430\u043d\u0435\u0435 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 node-netmask […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100946,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100945","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Luka w bibliotekach sieciowych j\u0119zyk\u00f3w Rust i Go, umo\u017cliwiaj\u0105ca omini\u0119cie weryfikacji adres\u00f3w IP | ProHoster","description":"W standardowych bibliotekach j\u0119zyk\u00f3w Rust i Go zidentyfikowano luki zwi\u0105zane z niew\u0142a\u015bciwym przetwarzaniem adres\u00f3w IP z cyframi \u00f3semkowymi w funkcjach analizy adres\u00f3w.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 | ProHoster","og:description":"\u0412 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u044f\u0437\u044b\u043a\u043e\u0432 Rust \u0438 Go \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u043e\u0439 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432 \u0441 \u0432\u043e\u0441\u044c\u043c\u0438\u0440\u0438\u0447\u043d\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u0431\u043e\u0440\u0430 \u0430\u0434\u0440\u0435\u0441\u0430.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-setevyh-bibliotekah-yazykov-rust-i-go-pozvolyayushhaya-obojti-proverku-ip-adresov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-08-08T14:22:47+00:00","article:modified_time":"2021-08-08T14:22:47+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100945","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-08-08 15:21:11","updated":"2026-02-08 20:40:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/100945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=100945"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/100945\/revisions"}],"predecessor-version":[{"id":158030,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/100945\/revisions\/158030"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/100946"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=100945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=100945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=100945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}