{"id":102176,"date":"2021-11-02T03:36:46","date_gmt":"2021-11-02T01:36:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster"},"modified":"2021-11-02T03:36:46","modified_gmt":"2021-11-02T01:36:46","slug":"uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster","title":{"rendered":"Zranite\u013enos\u0165, ktor\u00e1 umo\u017e\u0148uje vkladanie JavaScriptov\u00e9ho k\u00f3du prostredn\u00edctvom WordPress pluginu OptinMonster.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V dodatku WordPress OptinMonster, ktor\u00fd m\u00e1 viac ako mili\u00f3n akt\u00edvnych in\u0161tal\u00e1ci\u00ed a pou\u017e\u00edva sa na organizovanie zobrazenia vyskakovac\u00edch upozornen\u00ed a pon\u00fak, bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2021-39341), ktor\u00e1 umo\u017e\u0148uje umiestni\u0165 svoj JavaScript k\u00f3d na str\u00e1nku pou\u017e\u00edvaj\u00facu uveden\u00fd doplnok. Zranite\u013enos\u0165 bola odstr\u00e1nen\u00e1 vo verzii 2.6.5. Na zablokovanie pr\u00edstupu prostredn\u00edctvom zachyten\u00fdch k\u013e\u00fa\u010dov po in\u0161tal\u00e1cii aktualiz\u00e1cie v\u00fdvoj\u00e1ri OptinMonster anulovali v\u0161etky predt\u00fdm vytvoren\u00e9 pr\u00edstupov\u00e9 k\u013e\u00fa\u010de k API a pridali obmedzenia na pou\u017e\u00edvanie k\u013e\u00fa\u010dov WordPress str\u00e1nok na zmenu kampan\u00ed OptinMonster. <\/p>\n

Probl\u00e9m bol sp\u00f4soben\u00fd existenciou REST-API \/wp-json\/omapp\/v1\/support, ktor\u00e9mu bolo mo\u017en\u00e9 pristupova\u0165 bez autentifik\u00e1cie \u2014 po\u017eiadavka bola vykonan\u00e1 bez dodato\u010dn\u00fdch overen\u00ed pri pr\u00edtomnosti v hlavi\u010dke Referer re\u0165azca \u201ehttps:\/\/wp.app.optinmonster.test\u201c a pri nastaven\u00ed typu HTTP po\u017eiadavky na \u201eOPTIONS\u201c (prep\u00edna sa pomocou HTTP hlavi\u010dky \u201eX-HTTP-Method-Override\u201c). Medzi \u00fadajmi, ktor\u00e9 sa vracali pri volan\u00ed tohto REST-API, bol k\u013e\u00fa\u010d pr\u00edstupu, ktor\u00fd umo\u017e\u0148oval posiela\u0165 po\u017eiadavky na ak\u00e9ko\u013evek spracovate\u013esk\u00e9 moduly REST-API. <\/p>\n

Prostredn\u00edctvom z\u00edskan\u00e9ho k\u013e\u00fa\u010da mohol \u00fato\u010dn\u00edk vykona\u0165 zmeny v ak\u00fdchko\u013evek vyskakovac\u00edch blokoch zobrazen\u00fdch pomocou OptinMonster, vr\u00e1tane spustenia svojho JavaScript k\u00f3du. Z\u00edskan\u00edm mo\u017enosti vykona\u0165 svoj JavaScript k\u00f3d v kontexte str\u00e1nky mohol \u00fato\u010dn\u00edk presmerova\u0165 pou\u017e\u00edvate\u013eov na svoju str\u00e1nku alebo organizova\u0165 substit\u00faciu privilegovanej \u00fa\u010dtu v webovom rozhran\u00ed pri vykon\u00e1van\u00ed podstr\u010den\u00e9ho JavaScript k\u00f3du spr\u00e1vcom str\u00e1nky. S pr\u00edstupom do webov\u00e9ho rozhrania mohol \u00fato\u010dn\u00edk dosiahnu\u0165 vykonanie svojho PHP k\u00f3du na serveri<\/a>.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 OptinMonster, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u0432\u043e\u0434\u0430 \u0432\u0441\u043f\u043b\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-39341), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c \u0441\u0432\u043e\u0439 JavaScript-\u043a\u043e\u0434 \u043d\u0430 \u0441\u0430\u0439\u0442\u0435, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u043c \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u0435 \u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0435 2.6.5. \u0414\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0447\u0435\u0440\u0435\u0437 \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d\u043d\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 OptinMonster \u0430\u043d\u043d\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0432\u0441\u0435 \u0440\u0430\u043d\u0435\u0435 \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a API \u0438 \u0434\u043e\u0431\u0430\u0432\u0438\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102176","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165, ktor\u00e1 umo\u017e\u0148uje vkladanie JavaScript k\u00f3du prostredn\u00edctvom WordPress doplnku OptinMonster | ProHoster","description":"V dodatku WordPress OptinMonster, ktor\u00fd m\u00e1 viac ako mili\u00f3n akt\u00edvnych in\u0161tal\u00e1ci\u00ed a pou\u017e\u00edva sa na organizovanie zobrazenia vyskakovac\u00edch upozornen\u00ed a pon\u00fak, bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2021-39341), ktor\u00e1 umo\u017e\u0148uje umiestni\u0165.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 JavaScript-\u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 WordPress-\u043f\u043b\u0430\u0433\u0438\u043d OptinMonster | ProHoster","og:description":"\u0412 WordPress-\u0434\u043e\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 OptinMonster, \u0438\u043c\u0435\u044e\u0449\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u044b\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043e\u043a \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u0432\u043e\u0434\u0430 \u0432\u0441\u043f\u043b\u044b\u0432\u0430\u044e\u0449\u0438\u0445 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0438 \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-39341), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u0442\u044c.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-dopuskayushhaya-podstanovku-javascript-koda-cherez-wordpress-plagin-optinmonster","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-02T01:36:46+00:00","article:modified_time":"2021-11-02T01:36:46+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102176","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-02 01:36:50","updated":"2026-02-09 21:39:46","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/102176","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=102176"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/102176\/revisions"}],"predecessor-version":[{"id":159966,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/102176\/revisions\/159966"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=102176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=102176"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=102176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}