A empresa GitHub revelou informa\u00e7\u00f5es sobre dois incidentes na infraestrutura do reposit\u00f3rio de pacotes NPM. Em 2 de novembro, pesquisadores de seguran\u00e7a externos (Kajetan Grzybowski e Maciej Piechota) relataram, como parte do programa Bug Bounty, a exist\u00eancia de uma vulnerabilidade no reposit\u00f3rio NPM que permitia a publica\u00e7\u00e3o de uma nova vers\u00e3o de qualquer pacote, utilizando uma conta n\u00e3o autorizada para realizar tais atualiza\u00e7\u00f5es. <\/p>\n
A vulnerabilidade foi causada pela verifica\u00e7\u00e3o inadequada de permiss\u00f5es no c\u00f3digo dos microservi\u00e7os que processam as solicita\u00e7\u00f5es ao NPM. O servi\u00e7o de autoriza\u00e7\u00e3o realizava a verifica\u00e7\u00e3o de direitos de acesso aos pacotes com base nos dados transmitidos na solicita\u00e7\u00e3o, mas outro servi\u00e7o, que carregava a atualiza\u00e7\u00e3o no reposit\u00f3rio, determinava o pacote a ser publicado com base no conte\u00fado dos metadados no pacote carregado. Assim, o invasor poderia solicitar a publica\u00e7\u00e3o de uma atualiza\u00e7\u00e3o para seu pr\u00f3prio pacote, ao qual tinha acesso, mas indicar no pr\u00f3prio pacote as informa\u00e7\u00f5es de outro pacote que seria, na verdade, atualizado. <\/p>\n
O problema foi resolvido em 6 horas ap\u00f3s o surgimento da informa\u00e7\u00e3o sobre a vulnerabilidade, mas a vulnerabilidade esteve presente no NPM por mais tempo do que os logs de telemetria cobrem. O GitHub afirma que n\u00e3o foram registrados ind\u00edcios de ataques utilizando essa vulnerabilidade desde setembro de 2020, mas n\u00e3o h\u00e1 garantias de que o problema n\u00e3o foi explorado anteriormente. <\/p>\n
O segundo incidente ocorreu em 26 de outubro. Durante trabalhos t\u00e9cnicos com a base de dados do servi\u00e7o replicate.npmjs.com, foi identificado a presen\u00e7a de dados confidenciais acess\u00edveis a consultas externas na base de dados, revelando informa\u00e7\u00f5es sobre os nomes de pacotes internos mencionados no registro de mudan\u00e7as. Informa\u00e7\u00f5es sobre esses nomes podem ser usadas para realizar ataques a depend\u00eancias em projetos internos (em fevereiro, um ataque similar permitiu a execu\u00e7\u00e3o de c\u00f3digo em servidores<\/a> PayPal, Microsoft, Apple, Netflix, Uber e mais 30 empresas). <\/p>\n Al\u00e9m disso, devido ao aumento dos casos de sequestro de reposit\u00f3rios de grandes projetos e \u00e0 promo\u00e7\u00e3o de c\u00f3digos maliciosos por meio da compromiss\u00e3o de contas de desenvolvedores, a empresa GitHub decidiu implementar a autentica\u00e7\u00e3o em duas etapas obrigat\u00f3ria. A mudan\u00e7a entrar\u00e1 em vigor no primeiro trimestre de 2022 e se aplicar\u00e1 a mantenedores e administradores de pacotes inclu\u00eddos na lista dos mais populares. Tamb\u00e9m foi anunciado uma atualiza\u00e7\u00e3o na infraestrutura, que incluir\u00e1 monitoramento e an\u00e1lise automatizados de novas vers\u00f5es de pacotes para identifica\u00e7\u00e3o precoce de altera\u00e7\u00f5es maliciosas. <\/p>\n Vale lembrar que, de acordo com uma pesquisa realizada em 2020, apenas 9,27% dos mantenedores de pacotes utilizam autentica\u00e7\u00e3o de dois fatores para proteger o acesso, e em 13,37% dos casos, ao registrar novas contas, os desenvolvedores tentaram reutilizar senhas comprometidas que apareceram em vazamentos conhecidos. Durante a verifica\u00e7\u00e3o da confiabilidade das senhas usadas, foi poss\u00edvel acessar 12% das contas no NPM (13% dos pacotes) devido ao uso de senhas previs\u00edveis e triviais, como \"123456\". Entre os problemas identificados, estavam 4 contas de usu\u00e1rios do Top 20 dos pacotes mais populares, 13 contas cujos pacotes foram baixados mais de 50 milh\u00f5es de vezes por m\u00eas, 40 com mais de 10 milh\u00f5es de downloads mensais e 282 com mais de 1 milh\u00e3o de downloads mensais. Levando em conta o carregamento de m\u00f3dulos por meio de cadeias de depend\u00eancias, a compromiss\u00e3o de contas n\u00e3o confi\u00e1veis poderia afetar at\u00e9 52% de todos os m\u00f3dulos no NPM. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0432\u0443\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM. 2 \u043d\u043e\u044f\u0431\u0440\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (Kajetan Grzybowski \u0438 Maciej Piechota) \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Bug Bounty \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0441\u0432\u043e\u044e \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u043d\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102300","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilidade que permitia liberar uma atualiza\u00e7\u00e3o para qualquer pacote no reposit\u00f3rio NPM | ProHoster","description":"A empresa GitHub revelou informa\u00e7\u00f5es sobre dois incidentes na infraestrutura do reposit\u00f3rio de pacotes NPM.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0432\u0443\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-16T19:36:39+00:00","article:modified_time":"2021-11-16T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102300","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-16 19:37:47","updated":"2022-10-03 22:09:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/102300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=102300"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/102300\/revisions"}],"predecessor-version":[{"id":164408,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/102300\/revisions\/164408"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=102300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=102300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=102300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Fonte: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"