{"id":156092,"date":"2026-02-01T11:11:55","date_gmt":"2026-02-01T09:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone"},"modified":"2026-02-01T11:11:55","modified_gmt":"2026-02-01T09:11:55","slug":"atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","title":{"rendered":"Atakuj\u0105cym uda\u0142o si\u0119 doda\u0107 niezauwa\u017cony z\u0142o\u015bliwy kod do repozytorium Plone","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Deweloperzy wolnego systemu zarz\u0105dzania tre\u015bci\u0105 Plone, napisanego w Pythonie i JavaScript\/NodeJS, og\u0142osili o incydencie, w wyniku kt\u00f3rego do repozytorium git projektu na GitHubie dodano z\u0142o\u015bliwy kod. Pocz\u0105tkowo w repozytorium odnotowano trzy zmiany, kt\u00f3re mia\u0142y miejsce 7 stycznia (1, 2, 3), dodaj\u0105ce z\u0142o\u015bliwy kod do plik\u00f3w JavaScript projektu (1, 2, 3). Analiza incydentu wykaza\u0142a, \u017ce integracja z\u0142o\u015bliwego kodu by\u0142a wynikiem kompromitacji konta jednego z deweloper\u00f3w, kt\u00f3rego token dost\u0119pu zosta\u0142 przej\u0119ty przez cyberprzest\u0119pc\u00f3w po uruchomieniu z\u0142o\u015bliwego oprogramowania w jego systemie. <\/p>\n

14 stycznia skompromitowane konto zosta\u0142o zablokowane, a deweloperzy projektu zostali zaleceni do analizy commit\u00f3w z okresu od 1 do 14 stycznia. 27 stycznia odkryto, \u017ce zauwa\u017conymi commitami sprawa si\u0119 nie ogranicza i atak dotkn\u0105\u0142 pi\u0119ciu repozytori\u00f3w projektu (plone\/volto, plone\/mockup, plone\/plone.app.mosaic, plone\/critical-css-cli, plone\/plonetheme.barceloneta), w kt\u00f3re niezauwa\u017calnie zintegrowano z\u0142o\u015bliwy kod. W przypadku repozytorium plone.app.mosaic, atakuj\u0105cym uda\u0142o si\u0119 podmieni\u0107 ga\u0142\u0105\u017a master. Atak zosta\u0142 przeprowadzony dwa miesi\u0105ce po przej\u0119ciu tokena dost\u0119pu dewelopera. <\/p>\n

W celu integracji zmian, zamiast zwyk\u0142ych commit\u00f3w, atakuj\u0105cy wykorzystali operacj\u0119 «force push» (git push z opcj\u0105 «—force»), kt\u00f3ra pozwala na wymuszenie zast\u0105pienia ga\u0142\u0119zi w zewn\u0119trznym repozytorium jej zawarto\u015bci\u0105, a tym samym na przepisanie historii zmian (po zast\u0105pieniu wy\u015bwietlana jest historia z ga\u0142\u0119zi przes\u0142anej przez atakuj\u0105cego). Aby zapobiec takiej zamianie ga\u0142\u0119zi w przysz\u0142o\u015bci, deweloperzy Plone wprowadzili w GitHub zasady blokuj\u0105ce operacje «force push» dla g\u0142\u00f3wnych ga\u0142\u0119zi i tag\u00f3w. <\/p>\n

W repozytorium plone.app.mosaic, aby utrudni\u0107 wykrycie kompromitacji, atakuj\u0105cy wstawili do ga\u0142\u0119zi master z\u0142o\u015bliwy commit, maj\u0105cy fa\u0142szyw\u0105 dat\u0119 — 18 grudnia, maj\u0105c nadziej\u0119, \u017ce obszar poszukiwa\u0144 z\u0142o\u015bliwego kodu skupi si\u0119 na zmianach dodanych po ich pierwszej aktywno\u015bci w repozytorium. Z\u0142o\u015bliwa zmiana by\u0142a przedstawiana w podstawionym commicie jako pocz\u0105tek prac nad nowym testowym wydaniem, lecz opr\u00f3cz zmiany numeru wersji w metadanych (z 4.0.0a1 na 4.0.0a2.dev0) do wywo\u0142ywanego na etapie budowy pliku javascript‎ prettier.config.js dodano z\u0142o\u015bliwy kod. Aby ukry\u0107 go w widoku zmian w terminalu, kod zosta\u0142 dodany w jednej linii z legaln\u0105 operacj\u0105 i przesuni\u0119ty z widocznego obszaru przy u\u017cyciu spacji. W interfejsie GitHub kod ten r\u00f3wnie\u017c nie by\u0142 domy\u015blnie wy\u015bwietlany i wymaga\u0142 naci\u015bni\u0119cia przycisku «Load Diff».

\"Atakuj\u0105cym<\/center> <\/p>\n

Atak by\u0142 bardziej skierowany przeciwko deweloperom projektu ni\u017c u\u017cytkownikom. Z\u0142o\u015bliwe zmiany nie zosta\u0142y w\u0142\u0105czone do wydania. Z\u0142o\u015bliwy kod aktywowa\u0142 si\u0119 podczas budowy, \u0142adowa\u0142 exploit\u00f3w do podwy\u017cszania uprawnie\u0144, konfigurowa\u0142 autostart poprzez wywo\u0142anie swoich proces\u00f3w z skrypt\u00f3w uruchamiaj\u0105cych i umo\u017cliwia\u0142 zdalne zarz\u0105dzanie. serwerem<\/a>Ponadto zainstalowany z\u0142o\u015bliwy komponent prowadzi\u0142 wyszukiwanie i przesy\u0142anie poufnych danych, takich jak tokeny dost\u0119pu, profile przegl\u0105darek i klucze do portfeli kryptograficznych.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Plone, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Python \u0438 JavaScript\/NodeJS, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 GitHub \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0438\u0445\u0441\u044f 7 \u044f\u043d\u0432\u0430\u0440\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f (1, 2, 3), \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 JavaScript-\u0444\u0430\u0439\u043b\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 (1, 2, 3). \u0420\u0430\u0437\u0431\u043e\u0440 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":156093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-156092","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Napastnikom uda\u0142o si\u0119 doda\u0107 niezauwa\u017cony z\u0142o\u015bliwy kod do repozytorium Plone | ProHoster","description":"Deweloperzy otwartego systemu zarz\u0105dzania tre\u015bci\u0105 Plone, napisanego w Pythonie oraz JavaScript\/NodeJS, og\u0142osili o incydencie, w wyniku kt\u00f3rego do repozytorium git projektu na GitHubie dodano z\u0142o\u015bliwy kod.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Plone | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Plone, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Python \u0438 JavaScript\/NodeJS, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 GitHub \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-02-01T09:11:55+00:00","article:modified_time":"2026-02-01T09:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"156092","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:49:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-01 09:11:56","updated":"2026-02-09 21:49:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/156092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=156092"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/156092\/revisions"}],"predecessor-version":[{"id":160399,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/156092\/revisions\/160399"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/156093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=156092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=156092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=156092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}