{"id":100784,"date":"2021-07-17T22:22:35","date_gmt":"2021-07-17T20:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare"},"modified":"2021-07-17T22:22:35","modified_gmt":"2021-07-17T20:22:35","slug":"uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","title":{"rendered":"O vulnerabilitate \u00een cdnjs, care a permis executarea codului pe serverele Cloudflare","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen re\u021beaua de livrare a con\u021binutului cdnjs, pus\u0103 la dispozi\u021bie de Cloudflare pentru a accelera livrarea bibliotecilor JavaScript, a fost descoperit\u0103 o vulnerabilitate critic\u0103 care permite executarea de cod arbitrar pe serverele CDN. Pericolul problemei este amplificat de faptul c\u0103 aproximativ 12.7% din toate site-urile de pe internet folosesc acest serviciu pentru a desc\u0103rca biblioteci JavaScript, iar compromiterea infrastructurii permite \u00eenlocuirea bibliotecilor livrate de oricare dintre aceste site-uri. <\/p>\n

Serviciul cdnjs permite \u00eenc\u0103rcarea pachetelor din Git sau dintr-un depozit NPM, oferind posibilitatea oric\u0103rui site de a utiliza gratuit re\u021beaua de livrare de con\u021binut Cloudflare pentru a accelera \u00eenc\u0103rcarea bibliotecilor JavaScript. \u00cen timpul analizei codului componentelor cdnjs publicate pe GitHub, s-a constatat c\u0103 pentru dezarhivarea pachetelor NPM din arhivele tgz se folose\u0219te modulul standard archive\/tar scris \u00een Go, care returneaz\u0103 lista fi\u0219ierelor a\u0219a cum sunt, f\u0103r\u0103 normalizarea c\u0103ilor. \u00cen cazul \u00een care scriptul dezarhiveaz\u0103 con\u021binutul pe baza listei furnizate, prezen\u021ba unor fi\u0219iere de tip «..\\\/..\\\/..\\\/..\\\/..\\\/..\\\/..\\\/tmp\\\/test» \u00een arhiv\u0103 poate duce la rescrierea unor fi\u0219iere arbitrare \u00een sistem, \u00een func\u021bie de permisiuni. <\/p>\n

S-a presupus c\u0103 un atacator ar putea solicita ad\u0103ugarea bibliotecii sale \u00een cdnjs \u0219i ar putea \u00eenc\u0103rca \u00een depozitul NPM o arhiv\u0103 special conceput\u0103, con\u021bin\u00e2nd fi\u0219iere cu simboluri «..\\\/» \u00een cale. Pe serverele cdnjs, se efectueaz\u0103 periodic opera\u021biunea «autoupdate», \u00een timpul c\u0103reia procesorul \u00eencarc\u0103 versiuni noi ale bibliotecii propuse \u0219i dezarhiveaz\u0103 con\u021binutul. Prin intermediul fi\u0219ierelor cu c\u0103i «..\\\/», atacatorul ar putea ob\u021bine rescrierea fi\u0219ierelor cu scripturile serviciului \u0219i executarea propriului cod pe server<\/a> care a avut loc dezarhivarea. <\/p>\n

\u00cen cazul desc\u0103rc\u0103rii actualiz\u0103rilor din Git, s-a descoperit c\u0103 procesatorul de actualiz\u0103ri nu lua \u00een considerare link-urile simbolice atunci c\u00e2nd copia fi\u0219iere din Git. Aceast\u0103 caracteristic\u0103 permitea citirea oric\u0103ror fi\u0219iere cu server<\/a> prin ad\u0103ugarea de link-uri simbolice \u00een Git. <\/p>\n

Experimentele cu demonstrarea unei bre\u0219e \u00een cdnjs pentru a ob\u021bine recompense pe HackerOne au \u00eenceput prin testarea unei ipoteze referitoare la citirea fi\u0219ierelor. \u00cen depozitul Git al bibliotecii JavaScript distribuite prin CDN, a fost ad\u0103ugat\u0103 un link simbolic test.js, care face referire la fi\u0219ierul \/proc\/self\/maps. Dup\u0103 publicarea unei noi versiuni a bibliotecii, procesatorul de actualiz\u0103ri a gestionat acest depozit \u0219i a publicat fi\u0219ierul specificat \u00een cdnjs (test.js a fost creat ca un link simbolic \u0219i, la solicitarea acestui fi\u0219ier, se returna con\u021binutul \/proc\/self\/maps). <\/p>\n

\u00cenlocuind linkul simbolic cu fi\u0219ierul \/proc\/self\/environ, autorul cercet\u0103rii a observat c\u0103 datele returnate con\u021bin valori pentru variabilele de mediu GITHUB_REPO_API_KEY \u0219i WORKERS_KV_API_TOKEN. Prima variabil\u0103 con\u021binea cheia API pentru accesul cu drepturi de scriere \u00een depozitul robocdnjs de pe GitHub. A doua variabil\u0103 con\u021binea un token pentru stocarea KV \u00een cdnjs. Folosind informa\u021biile ob\u021binute, atacatorul ar fi putut face modific\u0103ri \u00een cdnjs \u0219i compromite complet infrastructura.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cloudflare \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 cdnjs, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0439 \u0434\u043b\u044f \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 CDN. \u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0443\u0433\u0443\u0431\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u043c, \u0447\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c \u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043e\u043a\u043e\u043b\u043e 12.7% \u0432\u0441\u0435\u0445 \u0441\u0430\u0439\u0442\u043e\u0432 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u043e\u0442\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u043b\u044e\u0431\u044b\u043c \u0438\u0437 \u044d\u0442\u0438\u0445 \u0441\u0430\u0439\u0442\u043e\u0432. \u0421\u0435\u0440\u0432\u0438\u0441 cdnjs \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100784","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een cdnjs, permi\u021b\u00e2nd executarea de cod pe serverele Cloudflare | ProHoster","description":"\u00cen re\u021beaua de livrare de con\u021binut cdnjs, furnizat\u0103 de Cloudflare pentru accelerarea livr\u0103rii bibliotecilor JavaScript, a fost identificat\u0103 o vulnerabilitate critic\u0103 care permite executarea de cod arbitrar pe servere.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 cdnjs, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Cloudflare | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cloudflare \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 cdnjs, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0439 \u0434\u043b\u044f \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-17T20:22:35+00:00","article:modified_time":"2021-07-17T20:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100784","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-17 22:01:30","updated":"2026-02-22 15:30:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=100784"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100784\/revisions"}],"predecessor-version":[{"id":162261,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100784\/revisions\/162261"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=100784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=100784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=100784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}