{"id":116725,"date":"2024-06-23T03:39:41","date_gmt":"2024-06-23T01:39:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz"},"modified":"2024-06-23T03:39:41","modified_gmt":"2024-06-23T01:39:41","slug":"uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz","title":{"rendered":"O vulnerabilitate \u00een pachetul Python Js2Py, desc\u0103rcat de peste un milion de ori pe lun\u0103","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen pachetul Python Js2Py, care a fost desc\u0103rcat de 1,2 milioane de ori luna trecut\u0103, a fost descoperit\u0103 o vulnerabilitate (CVE-2024-28397) care permite ocolirea izol\u0103rii sandbox \u0219i executarea de cod \u00een sistem atunci c\u00e2nd se proceseaz\u0103 date special formulate \u00een JavaScript. Vulnerabilitatea poate fi folosit\u0103 pentru a ataca programele care utilizeaz\u0103 Js2Py pentru a executa cod JavaScript. Solu\u021bia este disponibil\u0103 deocamdat\u0103 doar sub form\u0103 de patch. Un prototip de exploit a fost preg\u0103tit pentru a verifica posibilitatea atacului.<\/p>\n

Pachetul Js2Py implementeaz\u0103 un interpret \u0219i un translatator JavaScript, permi\u021b\u00e2nd executarea codului JavaScript \u00eentr-un mediu izolat ma\u0219ina virtual\u0103<\/a> sau traducerea JavaScript-ului \u00een Python. Proiectul este scris integral \u00een Python \u0219i nu utilizeaz\u0103 motoare JavaScript externe. \u00cen practic\u0103, biblioteca este folosit\u0103 \u00een diverse indexatoare web, sisteme de desc\u0103rcare \u0219i analizatori de site-uri, care suport\u0103 procesarea con\u021binutului generat de cod JavaScript. <\/p>\n

Printre aplica\u021biile afectate de vulnerabilitate se num\u0103r\u0103 Lightnovel Crawler (un utilitar pentru desc\u0103rcarea c\u0103r\u021bilor din servicii online \u0219i salvarea acestora \u00een diverse formate pentru citirea offline), cloudscraper (care ocole\u0219te automat paginile de protec\u021bie \u00eempotriva bot-urilor utilizate \u00een CDN Cloudflare) \u0219i pyLoad (un manager de desc\u0103rc\u0103ri care suport\u0103 procesarea paginilor generate de JavaScript). La procesarea con\u021binutului JavaScript special formulat \u00een aceste aplica\u021bii, un atacator poate reu\u0219i s\u0103 execute cod arbitrar la nivel de sistem.<\/p>\n

Vulnerabilitatea este prezent\u0103 \u00een implementarea unei variabile globale \u00een js2py, care permite ob\u021binerea unei referin\u021be la un obiect Python din codul JavaScript executat \u00een mediu izolat, indiferent de apelul metodei js2py.disable_pyimport() pentru a dezactiva importul obiectelor Python. Pentru a executa cod arbitrar \u00een sistem, atacatorul poate profita de vulnerabilitate pentru a accesa obiectul Popen din modulul Python subprocess. Este demn de remarcat faptul c\u0103 modificarea care solu\u021bioneaz\u0103 vulnerabilitatea a fost trimis\u0103 \u00een proiectul Js2Py pe 1 martie, dar dup\u0103 trei luni \u0219i jum\u0103tate nu a fost acceptat\u0103.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Python-\u043f\u0430\u043a\u0435\u0442\u0435 Js2Py, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 1.2 \u043c\u043b\u043d \u0440\u0430\u0437, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-28397), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 JavaScript. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0435 Js2Py \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f JavaScript-\u043a\u043e\u0434\u0430. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116725","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een pachetul Python Js2Py, desc\u0103rcat de peste un milion de ori pe lun\u0103 | ProHoster","description":"\u00cen pachetul Python Js2Py, care a fost desc\u0103rcat de 1,2 milioane de ori luna trecut\u0103, a fost descoperit\u0103 o vulnerabilitate (CVE-2024-28397) care permite ocolirea izol\u0103rii sandbox \u0219i executarea de cod \u00een sistem \u00een timpul proces\u0103rii unor date special formulate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Python-\u043f\u0430\u043a\u0435\u0442\u0435 Js2Py, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0433\u043e \u0431\u043e\u043b\u0435\u0435 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0440\u0430\u0437 \u0432 \u043c\u0435\u0441\u044f\u0446 | ProHoster","og:description":"\u0412 Python-\u043f\u0430\u043a\u0435\u0442\u0435 Js2Py, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 1.2 \u043c\u043b\u043d \u0440\u0430\u0437, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-28397), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-06-23T01:39:41+00:00","article:modified_time":"2024-06-23T01:39:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 02:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 02:44:19","updated":"2026-01-23 02:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/116725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=116725"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/116725\/revisions"}],"predecessor-version":[{"id":164216,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/116725\/revisions\/164216"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=116725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=116725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=116725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}