{"id":163792,"date":"2026-03-10T23:11:57","date_gmt":"2026-03-10T21:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy"},"modified":"2026-03-10T23:11:57","modified_gmt":"2026-03-10T21:11:59","slug":"uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","title":{"rendered":"Vulnerabilit\u0103\u021bile din proiectul Pingora, care permit intercep\u021bia cererilor externe","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Cloudflare a anun\u021bat remedierea a trei vulnerabilit\u0103\u021bi \u00een cadrul framework-ului Pingora, dou\u0103 dintre ele av\u00e2nd un nivel critic de severitate (9.3 din 10). Framework-ul Pingora este scris \u00een limbajul Rust \u0219i este destinat dezvolt\u0103rii de servicii de re\u021bea de \u00eenalt\u0103 performan\u021b\u0103 \u0219i securizate. Proxy-ul construit cu ajutorul Pingora este utilizat \u00een re\u021beaua de livrare a con\u021binutului Cloudflare \u0219i proceseaz\u0103 peste 40 de milioane de cereri pe secund\u0103. Vulnerabilit\u0103\u021bile au fost remediate \u00een versiunea Pingora 0.8.0. <\/p>\n

Cele mai periculoase dou\u0103 vulnerabilit\u0103\u021bi permit atacuri de tip \u201eHTTP Request Smuggling\u201d, care permit ocolirea sistemelor de limitare a accesului \u0219i interceptarea con\u021binutului solicit\u0103rilor altor utilizatori, procesate \u00een acela\u0219i flux \u00eentre frontend \u0219i backend (de exemplu, pentru inserarea de cod JavaScript mali\u021bios \u00een sesiunea unui alt utilizator pe site). Problemele au fost identificate de un participant la programul Bug Bounty, care prevede recompense pentru descoperirea vulnerabilit\u0103\u021bilor. <\/p>\n

\u00cen schema de accesare a backend-ului printr-un proxy invers, solicit\u0103rile clien\u021bilor sunt preluate de un nod suplimentar, care stabile\u0219te o conexiune TCP de lung\u0103 durat\u0103 cu backend-ul, care proceseaz\u0103 direct solicit\u0103rile. Prin aceast\u0103 conexiune comun\u0103 sunt de obicei transmise solicit\u0103rile diferitelor utilizatori, care sunt procesate \u00een serie, separate prin mijloacele protocolului HTTP. Atacurile de tip HTTP Request Smuggling apar din cauza interpret\u0103rilor diferite ale header-elor HTTP \u0219i specifica\u021biilor protocolului HTTP pe frontend-uri \u0219i backend-uri, de exemplu, atunci c\u00e2nd frontend-ul folose\u0219te header-ul HTTP \u201eContent-Length\u201d pentru a determina dimensiunea unei solicit\u0103ri, iar backend-ul \u201eTransfer-Encoding: chunked.\u201d <\/p>\n

Prima vulnerabilitate CVE-2026-2835 este prezent\u0103 \u00een codul de analiz\u0103 a solicit\u0103rilor HTTP\/1.0 \u0219i este provocat\u0103 de procesarea incorect\u0103 a header-ului \u201eTransfer-Encoding\u201d cu mai multe valori \u0219i de utilizarea \u00eenchiderii conexiunii ca un semn al sf\u00e2r\u0219itului corpului solicit\u0103rii (close-delimited). Pingora verifica doar varianta \u201eTransfer-Encoding: chunked\u201d \u0219i ignora acest header dac\u0103 acesta con\u021bine mai multe valori. \u00cen aceast\u0103 situa\u021bie, Pingora nu lua \u00een calcul dimensiunea din header-ul \u201eContent-Length\u201d, consider\u00e2nd corpul solicit\u0103rii toate datele primite p\u00e2n\u0103 la \u00eenchiderea conexiunii. <\/p>\n

Prin specificarea mai multor valori \u00een header-ul \u201eTransfer-Encoding\u201d, atacatorul putea crea condi\u021bii \u00een care pe backend era redirec\u021bionat\u0103 o solicitare a c\u0103rei dimensiune efectiv\u0103 nu corespundea dimensiunii lan\u021bului chunked, calculat\u0103 pe baza header-ului \u201eTransfer-Encoding\u201d. Pingora redirec\u021biona toate datele primite ca o singur\u0103 solicitare, iar backend-ul, de exemplu, Node.js, calcula solicitarea pe baza \u201eTransfer-Encoding: chunked\u201d \u0219i gestiona restul ca \u00eenceputul unei alte solicit\u0103ri. GET \/ HTTP\/1.0 Host: example.com Connection: keep-alive Transfer-Encoding: identity, chunked Content-Length: 29 0 GET \/admin HTTP\/1.1 X:

\"Vulnerabilit\u0103\u021bile<\/center> <\/p>\n

A doua vulnerabilitate CVE-2026-2833 este cauzat\u0103 de prelucrarea incorect\u0103 a antetului HTTP \u201eUpgrade\u201d \u00een cererile HTTP\/1.1. C\u00e2nd cererea con\u021binea antetul \u201eUpgrade\u201d, proxy-ul trimitea imediat datele cererii c\u0103tre backend, f\u0103r\u0103 a a\u0219tepta un r\u0103spuns de la backend cu codul 101 (Switching Protocols). Din aceast\u0103 cauz\u0103, sincronizarea fluxului \u00eentre proxy \u0219i backend era afectat\u0103, iar backend-ul percepea datele trimise dup\u0103 antetul \u201eUpgrade\u201d ca pe o cerere separat\u0103, return\u00e2nd rezultatul execut\u0103rii acestei cereri ca r\u0103spuns la cererea ulterioar\u0103 a altui utilizator. GET \/ HTTP\/1.1 Host: example.com Upgrade: foo GET \/admin HTTP\/1.1 Host: example.com

\"Vulnerabilit\u0103\u021bile<\/center>
\"Vulnerabilit\u0103\u021bile<\/center> <\/p>\n

Problemele apar atunci c\u00e2nd se utilizeaz\u0103 Pingora \u00een calitate de proxy invers (ingress proxy), care transform\u0103 cererile utilizatorilor c\u0103tre backend-uri folosind protocoale HTTP\/1.0 sau HTTP\/1.1. Configura\u021bia Pingora utilizat\u0103 \u00een re\u021beaua de livrare a con\u021binutului Cloudflare nu permitea exploatarea vulnerabilit\u0103\u021bilor, deoarece Pingora \u00een CDN nu este utilizat ca proxy invers, redirec\u021bion\u00e2nd cererile doar cu protocolul HTTP\/1.1, blocheaz\u0103 cererile cu valori incorecte ale Content-Length, redirec\u021bioneaz\u0103 doar o singur\u0103 valoare pentru antetul \u201eTransfer-Encoding: chunked\u201d \u0219i adaug\u0103 \u00een cererile cu antetul \u201eUpgrade:\u201d un antet suplimentar \u201eConnection: close\u201d, care \u00eempiedic\u0103 transmiterea unor cereri suplimentare \u00een aceea\u0219i conexiune. <\/p>\n

A treia vulnerabilitate CVE-2026-2836 (grad de severitate 8.4 din 10) duce la contaminarea cache-ului (cache poisoning) din cauza gener\u0103rii cheii de plasare a datelor \u00een cache (CacheKey) doar pe baza c\u0103ii din URI, ignor\u00e2nd con\u021binutul antetului \u201eHost\u201d. Aceast\u0103 deficien\u021b\u0103 duce la generarea unor chei de cache identice pentru c\u0103i HTTP identice c\u0103tre diferite host-uri. Vulnerabilitatea poate fi folosit\u0103 pentru a modifica con\u021binutul cache-ului atunci c\u00e2nd se utilizeaz\u0103 modul de caching pentru mai multe host-uri. \u00cen Pingora, caching-ul este o func\u021bie experimental\u0103, care nu este recomandat\u0103 pentru implement\u0103ri \u00een produc\u021bie.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Pingora, \u0434\u0432\u0443\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10). \u0424\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a Pingora \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432. \u041f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Pingora \u043f\u0440\u043e\u043a\u0441\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Cloudflare \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 40 \u043c\u043b\u043d \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432 \u0441\u0435\u043a\u0443\u043d\u0434\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":163793,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-163792","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilit\u0103\u021bi \u00een proiectul Pingora care permit interven\u021bia \u00een cererile externe | ProHoster","description":"Compania Cloudflare a anun\u021bat remediera a trei vulnerabilit\u0103\u021bi \u00een cadrul framework-ului Pingora, dou\u0103 dintre ele av\u00e2nd un nivel critic de gravitate (9.3 din 10).","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0435 Pingora, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u043a\u043b\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Pingora, \u0434\u0432\u0443\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10).","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-10T21:11:59+00:00","article:modified_time":"2026-03-10T21:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/163792","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=163792"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/163792\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/163793"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=163792"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=163792"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=163792"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}