{"id":86356,"date":"2020-06-24T13:42:00","date_gmt":"2020-06-24T11:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda"},"modified":"2020-06-24T13:42:00","modified_gmt":"2020-06-24T11:42:00","slug":"uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","title":{"rendered":"Luka w zabezpieczonej przegl\u0105darce Bitdefender SafePay prowadz\u0105ca do mo\u017cliwo\u015bci wykonania kodu","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

W\u0142odzimierz Palant, tw\u00f3rca Adblock Plus, ujawni\u0142<\/a><\/noindex> luka<\/a><\/noindex> (CVE-2020-8102<\/a><\/noindex>) w przegl\u0105darce web Safepay, opartej na silniku Chromium, kt\u00f3ra jest cz\u0119\u015bci\u0105 pakietu antywirusowego Bitdefender Total Security 2020 i ma na celu zwi\u0119kszenie bezpiecze\u0144stwa u\u017cytkownik\u00f3w w sieci (np. zapewnia dodatkow\u0105 izolacj\u0119 przy dost\u0119pie do bank\u00f3w i system\u00f3w p\u0142atno\u015bci). Luka umo\u017cliwia otwieranym w przegl\u0105darce stronom internetowym wykonywanie dowolnego kodu na poziomie systemu operacyjnego.<\/p>\n

Przyczyn\u0105 problemu jest to, \u017ce program antywirusowy Bitdefender wykonuje lokalne przechwytywanie ruchu HTTPS poprzez podmian\u0119 oryginalnego certyfikatu TLS strony. Na systemie klienta instalowany jest dodatkowy certyfikat root, kt\u00f3ry pozwala ukry\u0107 dzia\u0142anie stosowanego systemu inspekcji ruchu. Program antywirusowy wkracza w zabezpieczony ruch i w niekt\u00f3rych stronach podk\u0142ada w\u0142asny kod JavaScript w celu realizacji funkcji Safe Search, a w przypadku problem\u00f3w z certyfikatem zabezpieczonym po\u0142\u0105czeniem podmienia wy\u015bwietlan\u0105 stron\u0119 z b\u0142\u0119dem na w\u0142asn\u0105. Poniewa\u017c nowa strona z b\u0142\u0119dem jest wydawana w imieniu otwieranego serwera, inne strony tego serwera maj\u0105 pe\u0142ny dost\u0119p do zawarto\u015bci wstawionej przez Bitdefender.<\/p>\n

Po otwarciu strony kontrolowanej przez przest\u0119pc\u0119, ta strona mo\u017ce wys\u0142a\u0107 zapytanie XMLHttpRequest i zasymulowa\u0107 problemy z certyfikatem HTTPS w odpowiedzi, co spowoduje zwr\u00f3cenie strony z b\u0142\u0119dem, podmiany przez Bitdefender. Poniewa\u017c strona z b\u0142\u0119dem jest otwarta w kontek\u015bcie domeny atakuj\u0105cego, mo\u017ce on odczyta\u0107 zawarto\u015b\u0107 podmienionej strony z parametrami Bitdefender. Na podmienionej stronie Bitdefender znajduje si\u0119 r\u00f3wnie\u017c klucz sesji, kt\u00f3ry pozwala poprzez wewn\u0119trzne API Bitdefender uruchomi\u0107 oddzieln\u0105 sesj\u0119 przegl\u0105darki Safepay, podaj\u0105c przy tym dowolne flagi linii polece\u0144 i uzyska\u0107 uruchomienie dowolnych polece\u0144 systemowych za pomoc\u0105 flagi \u00ab\u2014utility-cmd-prefix\u00bb. Przyk\u0142ad exploita (param1 i param2 \u2014 warto\u015bci uzyskane ze strony z b\u0142\u0119dem):<\/p>\n

var request = new XMLHttpRequest();
\n request.open('POST', Math.random());
\n request.setRequestHeader('Content-type', 'application\/x-www-form-urlencoded');
\n request.setRequestHeader('BDNDSS_B67EA559F21B487F861FDA8A44F01C50', param1);
\n request.setRequestHeader('BDNDCA_BBACF84D61A04F9AA66019A14B035478', param2);
\n request.setRequestHeader('BDNDWB_5056E556833D49C1AF4085CB254FC242', 'obk.run');
\n request.setRequestHeader('BDNDOK_4E961A95B7B44CBCA1907D3D3643370D', location.href);
\n request.send('data:text\/html,nada \u2014utility-cmd-prefix=\\cmd.exe \/k whoami & echo\\>');<\/p>\n

\"Luka<\/a><\/noindex><\/center><\/p>\n

Warto przypomnie\u0107, \u017ce przeprowadzone w 2017 roku badanie pokaza\u0142y<\/a><\/noindex>, \u017ce 24 z 26 przetestowanych produkt\u00f3w antywirusowych, kt\u00f3re inspekcjonowa\u0142y ruch HTTPS poprzez podmienianie certyfikat\u00f3w, obni\u017ca\u0142y og\u00f3lny poziom bezpiecze\u0144stwa po\u0142\u0105cze\u0144 HTTPS.
\nAktualne zestawy szyfr\u00f3w by\u0142y dostarczane tylko w 11 z 26 produkt\u00f3w. 5 system\u00f3w nie weryfikowa\u0142o certyfikat\u00f3w (Kaspersky Internet Security 16 Mac, NOD32 AV 9, CYBERsitter, Net Nanny 7 Win, Net Nanny 7 Mac). Produkty Kaspersky Internet Security i Total Security by\u0142y podatne na ataki CRIME<\/a><\/noindex>, a produkty AVG, Bitdefender i Bullguard by\u0142y nara\u017cone na ataki Logjam<\/a><\/noindex> i POODLE<\/a><\/noindex>. Produkt Dr.Web Antivirus 11 pozwala na powr\u00f3t do niesolidnych eksportowych szyfr\u00f3w (atak FREAK<\/a><\/noindex>).<\/p>\n

<\/a><\/noindex><\/p>\n

\u0179r\u00f3d\u0142o: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u043b\u0430\u0434\u0438\u043c\u0438\u0440 \u041f\u0430\u043b\u0430\u043d\u0442, \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c Adblock Plus, \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8102) \u0432 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0430 \u0434\u0432\u0438\u0436\u043a\u0435 Chromium \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c web-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Safepay, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 Bitdefender Total Security 2020 \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0431\u0430\u043d\u043a\u0430\u043c \u0438 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u043c \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \u0441\u0430\u0439\u0442\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86357,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-86356","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Luka w zabezpieczonej przegl\u0105darki Bitdefender SafePay, prowadz\u0105ca do wykonania kodu | ProHoster","description":"Wladimir Palant, tw\u00f3rca Adblock Plus, ujawni\u0142","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u043c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Bitdefender SafePay, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412\u043b\u0430\u0434\u0438\u043c\u0438\u0440 \u041f\u0430\u043b\u0430\u043d\u0442, \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c Adblock Plus, \u0432\u044b\u044f\u0432\u0438\u043b","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-24T11:42:00+00:00","article:modified_time":"2020-06-24T11:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86356","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:17:32","updated":"2022-09-28 12:42:50","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/86356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=86356"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/86356\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media\/86357"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=86356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=86356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=86356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}