{"id":31710,"date":"2019-10-31T21:42:39","date_gmt":"2019-10-31T18:42:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov\/"},"modified":"2019-10-31T21:42:39","modified_gmt":"2019-10-31T18:42:39","slug":"uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","title":{"rendered":"Luka w Adblock Plus, pozwalaj\u0105ca na wykonanie kodu przy u\u017cyciu w\u0105tpliwych filtr\u00f3w","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>W blokadorze reklam Adblock Plus <noindex><a rel=\"nofollow\" href=\"https:\/\/adblockplus.org\/blog\/potential-vulnerability-through-the-url-rewrite-filter-option\">wykryto<\/a><\/noindex> istnieje luka, <noindex><a rel=\"nofollow\" href=\"https:\/\/armin.dev\/blog\/2019\/04\/adblock-plus-code-injection\/\">pozwalaj\u0105ca<\/a><\/noindex> pozwalaj\u0105ca na wykonanie kodu JavaScript w kontek\u015bcie stron internetowych, w przypadku u\u017cycia niezweryfikowanych filtr\u00f3w przygotowanych przez osoby trzecie (na przyk\u0142ad przy po\u0142\u0105czeniu z zewn\u0119trznymi zestawami regu\u0142 lub poprzez podstawienie regu\u0142 podczas ataku MITM).<\/p>\n<p>Autorzy list z zestawami filtr\u00f3w mog\u0105 zorganizowa\u0107 wykonanie swojego kodu w kontek\u015bcie otwieranych przez u\u017cytkownika stron internetowych poprzez dodanie regu\u0142 z operatorem &#171;<noindex><a rel=\"nofollow\" href=\"https:\/\/help.eyeo.com\/en\/adblockplus\/how-to-write-filters#rewrite\">rewrite<\/a><\/noindex>&#171; umo\u017cliwiaj\u0105cym zast\u0119powanie cz\u0119\u015bci URL. Operator rewrite nie pozwala na zmian\u0119 hosta w URL, ale daje mo\u017cliwo\u015b\u0107 swobodnego manipulowania argumentami zapytania. Jako maski do zast\u0119powania dozwolone jest stosowanie jedynie tekstu, natomiast podstawianie tag\u00f3w script, object oraz subdocumentu <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/adblockplus\/adblockpluscore\/blob\/247943b2fa3464521bfee90edcbba5e64d29434e\/lib\/filterClasses.js#L1076\">blokowany<\/a><\/noindex>. <\/p>\n<p>Niemniej jednak, wykonanie kodu mo\u017cna osi\u0105gn\u0105\u0107 po\u015brednio.<br \/>\nNiekt\u00f3re strony, w tym Google Maps, Gmail i Google Images, stosuj\u0105 technik\u0119 dynamicznego \u0142adowania wykonywalnych blok\u00f3w JavaScript, przekazywanych w formie surowego tekstu. Je\u015bli serwer pozwala na przekierowanie zapyta\u0144, to mo\u017cna uzyska\u0107 przekierowanie na inny host, zmieniaj\u0105c parametry URL (na przyk\u0142ad w kontek\u015bcie Google przekierowanie mo\u017ce by\u0107 zrealizowane przez API &#171;<noindex><a rel=\"nofollow\" href=\"https:\/\/www.google.com\/search?hl=en-US&#038;source=hp&#038;biw=&#038;bih=&#038;q=majestic-ramsons.herokuapp.com&#038;btnI=I%27m+Feeling+Lucky&#038;gbv=1\">google.com\/search<\/a><\/noindex>&#171;). Opr\u00f3cz host\u00f3w, kt\u00f3re pozwalaj\u0105 na przekierowanie, atak mo\u017ce by\u0107 r\u00f3wnie\u017c skierowany przeciwko us\u0142ugom umo\u017cliwiaj\u0105cym umieszczanie tre\u015bci u\u017cytkownik\u00f3w (hosting kodu, platformy publikacji artyku\u0142\u00f3w itp.).<\/p>\n<p>Proponowana metoda ataku dotyczy jedynie stron, kt\u00f3re dynamicznie \u0142aduj\u0105 ci\u0105gi z kodem JavaScript (na przyk\u0142ad przez XMLHttpRequest lub Fetch) i nast\u0119pnie je wykonuj\u0105. Innym wa\u017cnym ograniczeniem jest konieczno\u015b\u0107 u\u017cycia przekierowania lub umieszczenia dowolnych danych po stronie serwera \u017ar\u00f3d\u0142owego dostarczaj\u0105cego zas\u00f3b. Niemniej jednak, w celu zademonstrowania aktualno\u015bci ataku pokazano, jak zorganizowa\u0107 wykonanie swojego kodu przy otwieraniu maps.google.com, u\u017cywaj\u0105c przekierowania przez &#171;google.com\/search&#187;.<\/p>\n<p>Naprawa jest obecnie w trakcie przygotowania. Problem dotyczy r\u00f3wnie\u017c blokator\u00f3w  <noindex><a rel=\"nofollow\" href=\"https:\/\/getadblock.com\/\">AdBlock<\/a><\/noindex> i <noindex><a rel=\"nofollow\" href=\"https:\/\/www.ublock.org\/\">uBlock<\/a><\/noindex>. Blokada uBlock Origin nie jest na to podatna, poniewa\u017c nie obs\u0142uguje operatora &#171;rewrite&#187;. W swoim czasie autor uBlock Origin<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/uBlockOrigin\/uBlock-issues\/issues\/46#issuecomment-391303700\">odm\u00f3wi\u0142<\/a><\/noindex> dodawanie wsparcia dla rewrite, powo\u0142uj\u0105c si\u0119 na potencjalne problemy z bezpiecze\u0144stwem i niewystarczaj\u0105ce ograniczenia na poziomie hosta (zamiast rewrite zaproponowano opcj\u0119 querystrip do oczyszczania parametr\u00f3w zapytania zamiast ich zast\u0119powania).<\/p>\n<p>Programi\u015bci Adblock Plus uwa\u017caj\u0105, \u017ce przeprowadzenie rzeczywistych atak\u00f3w jest ma\u0142o prawdopodobne, poniewa\u017c wszystkie zmiany w standardowych listach regu\u0142 s\u0105 recenzowane, a korzystanie z zewn\u0119trznych list jest przez u\u017cytkownik\u00f3w praktykowane niezwykle rzadko. Zast\u0105pienie regu\u0142 za pomoc\u0105 MITM wyklucza domy\u015blne u\u017cycie HTTPS do \u0142adowania standardowych list blokowania (dla pozosta\u0142ych list planowane jest zablokowanie \u0142adowania przez HTTP w przysz\u0142ej wersji). W celu zablokowania atak\u00f3w po stronie stron internetowych mo\u017cna zastosowa\u0107 dyrektywy <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Content_Security_Policy\">CSP<\/a><\/noindex> (Content Security Policy), za pomoc\u0105 kt\u00f3rych mo\u017cna wyra\u017anie okre\u015bli\u0107 hosty, z kt\u00f3rych dozwolone jest \u0142adowanie zewn\u0119trznych zasob\u00f3w. <\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>\u0179r\u00f3d\u0142o: <a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=50521\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0441\u0430\u0439\u0442\u043e\u0432, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b \u0438\u043b\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043f\u0440\u0430\u0432\u0438\u043b \u0432 \u0445\u043e\u0434\u0435 MITM-\u0430\u0442\u0430\u043a\u0438). \u0410\u0432\u0442\u043e\u0440\u044b \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u0441 \u043d\u0430\u0431\u043e\u0440\u0430\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 \u043c\u043e\u0433\u0443\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b \u0441 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u043c &#171;rewrite&#171;, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31710","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c,\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"pl_PL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Adblock Plus, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c,\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:42:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:42:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Podatno\u015b\u0107 w Adblock Plus, kt\u00f3ra pozwala na wykonanie kodu przy u\u017cyciu w\u0105tpliwych filtr\u00f3w | ProHoster","description":"W blokatorze reklam Adblock Plus zidentyfikowano podatno\u015b\u0107,","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Adblock Plus, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 | ProHoster","og:description":"\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c,","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:39+00:00","article:modified_time":"2019-10-31T18:42:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31710","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 07:28:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:12:33","updated":"2026-01-21 07:28:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/31710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=31710"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/31710\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=31710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=31710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=31710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}