Compania GitHub a dezv\u0103luit informa\u021bii despre dou\u0103 incidente \u00een infrastructura depozitului de pachete NPM. Pe 2 noiembrie, cercet\u0103tori de securitate externi (Kajetan Grzybowski \u0219i Maciej Piechota) au raportat \u00een cadrul programului Bug Bounty c\u0103 \u00een depozitul NPM exista o vulnerabilitate care permitea publicarea unei versiuni noi a oric\u0103rui pachet, folosind un cont care nu era autorizat pentru a efectua astfel de actualiz\u0103ri. <\/p>\n
Vulnerabilitatea a fost cauzat\u0103 de o verificare incorect\u0103 a autoriz\u0103rii \u00een codul microservicelor care gestionau cererile c\u0103tre NPM. Serviciul de autorizare efectua verific\u0103ri de acces la pachete bazate pe datele transmise \u00een cerere, dar un alt serviciu, care \u00eenc\u0103rca actualiz\u0103rile \u00een depozit, determina pachetul de publicat baz\u00e2ndu-se pe con\u021binutul metadatelor din pachetul \u00eenc\u0103rcat. Astfel, un atacator putea solicita publicarea unei actualiz\u0103ri pentru pachetul s\u0103u la care avea acces, dar putea specifica \u00een pachetul respectiv informa\u021biile despre un alt pachet care ar fi fost, \u00een final, actualizat. <\/p>\n
Problema a fost rezolvat\u0103 la 6 ore dup\u0103 apari\u021bia informa\u021biilor despre vulnerabilitate, dar aceasta a fost prezent\u0103 \u00een NPM mai mult timp dec\u00e2t acoper\u0103 jurnalele cu telemetrie. GitHub afirm\u0103 c\u0103 nu au fost \u00eenregistrate dovezi ale atacurilor folosind aceast\u0103 vulnerabilitate din septembrie 2020, dar nu exist\u0103 garan\u021bii c\u0103 problema nu a fost exploatat\u0103 anterior. <\/p>\n
Al doilea incident a avut loc pe 26 octombrie. \u00cen cadrul unor lucr\u0103ri tehnice la baza de date a serviciului replicate.npmjs.com, a fost identificat\u0103 prezen\u021ba unor date confiden\u021biale accesibile solicit\u0103rilor externe, care dezv\u0103luiau informa\u021bii despre numele pachetelor interne men\u021bionate \u00een jurnalul de modific\u0103ri. Informa\u021biile despre astfel de nume pot fi utilizate pentru a desf\u0103\u0219ura atacuri asupra dependen\u021belor \u00een proiectele interne (\u00een februarie, un atac similar a permis executarea de cod pe servere<\/a> PayPal, Microsoft, Apple, Netflix, Uber \u0219i \u00eenc\u0103 30 de companii). <\/p>\n \u00cen plus, av\u00e2nd \u00een vedere cre\u0219terea frecven\u021bei cazurilor de capturare a repositoarelor proiectelor mari \u0219i promovarea codului mali\u021bios prin compromiterea conturilor dezvoltatorilor, compania GitHub a decis s\u0103 introduc\u0103 autentificarea cu doi factori ca fiind obligatorie. Modificarea va intra \u00een vigoare \u00een primul trimestru al anului 2022 \u0219i va fi aplicat\u0103 persoanelor care \u00eentre\u021bin \u0219i administreaz\u0103 pachetele incluse \u00een lista celor mai populare. De asemenea, se raporteaz\u0103 o modernizare a infrastructurii, \u00een care va fi implementat un sistem automatizat de monitorizare \u0219i analiz\u0103 a noilor versiuni de pachete pentru identificarea timpurie a modific\u0103rilor mali\u021bioase. <\/p>\n Reamintim c\u0103, conform unui studiu realizat \u00een 2020, doar 9,27% dintre men\u021binerii pachetelor folosesc autentificarea cu doi factori pentru a proteja accesul, iar \u00een 13,37% din cazuri, la \u00eenregistrarea unor conturi noi, dezvoltatorii au \u00eencercat s\u0103 foloseasc\u0103 parole compromise, ap\u0103rute \u00een bre\u0219e de date cunoscute. \u00cen urma verific\u0103rii solidit\u0103\u021bii parolelor utilizate, s-a reu\u0219it accesul la 12% dintre conturile NPM (13% dintre pachete) din cauza utiliz\u0103rii unor parole previzibile \u0219i triviale, cum ar fi \u201e123456\u201d. Printre conturile problematice s-au num\u0103rat 4 conturi de utilizator din Top 20 cele mai populare pachete, 13 conturi ale c\u0103ror pachete au fost desc\u0103rcate de peste 50 milioane de ori pe lun\u0103, 40 de conturi cu peste 10 milioane de desc\u0103rc\u0103ri pe lun\u0103 \u0219i 282 cu mai mult de 1 milion de desc\u0103rc\u0103ri pe lun\u0103. Av\u00e2nd \u00een vedere \u00eenc\u0103rcarea modulelor pe baza lan\u021bului de dependen\u021be, compromiterea conturilor nesigure ar fi putut afecta p\u00e2n\u0103 la 52% din toate modulele NPM. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0432\u0443\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM. 2 \u043d\u043e\u044f\u0431\u0440\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (Kajetan Grzybowski \u0438 Maciej Piechota) \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Bug Bounty \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0441\u0432\u043e\u044e \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u043d\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102300","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate care permitea eliberarea unui update pentru orice pachet din repositoarele NPM | ProHoster","description":"Compania GitHub a dezv\u0103luit informa\u021bii despre dou\u0103 incidente din infrastructura repositoarelor de pachete NPM.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0432\u0443\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-16T19:36:39+00:00","article:modified_time":"2021-11-16T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102300","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-16 19:37:47","updated":"2022-10-03 22:09:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=102300"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102300\/revisions"}],"predecessor-version":[{"id":164408,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/102300\/revisions\/164408"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=102300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=102300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=102300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"