{"id":156092,"date":"2026-02-01T11:11:55","date_gmt":"2026-02-01T09:11:55","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone"},"modified":"2026-02-01T11:11:55","modified_gmt":"2026-02-01T09:11:55","slug":"atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","title":{"rendered":"\u00dato\u010dn\u00edkom sa podarilo prida\u0165 nezaznamenan\u00fd \u0161kodliv\u00fd k\u00f3d do repozit\u00e1ra Plone","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdvoj\u00e1ri otvoren\u00e9ho syst\u00e9mu spr\u00e1vy obsahu Plone, nap\u00edsan\u00e9ho v Pythone a JavaScripte\/NodeJS, ozn\u00e1mili incident, pri ktorom bol do git-repozit\u00e1ra projektu na GitHube pridan\u00fd \u0161kodliv\u00fd k\u00f3d. P\u00f4vodne boli v repozit\u00e1ri zisten\u00e9 tri zmeny z 7. janu\u00e1ra (1, 2, 3), ktor\u00e9 pridali \u0161kodliv\u00fd k\u00f3d do JavaScriptov\u00fdch s\u00faborov projektu (1, 2, 3). Anal\u00fdza incidentu uk\u00e1zala, \u017ee integr\u00e1cia \u0161kodliv\u00e9ho k\u00f3du bola vykonan\u00e1 v d\u00f4sledku kompromit\u00e1cie \u00fa\u010dtu jedn\u00e9ho z v\u00fdvoj\u00e1rov, ktor\u00e9ho pr\u00edstupov\u00fd token bol zachyten\u00fd \u00fato\u010dn\u00edkmi po spusten\u00ed \u0161kodliv\u00e9ho softv\u00e9ru v jeho syst\u00e9me. <\/p>\n

14. janu\u00e1ra bol kompromitovan\u00fd \u00fa\u010det zablokovan\u00fd a v\u00fdvoj\u00e1rom projektu bolo odpor\u00fa\u010dan\u00e9 analyzova\u0165 commity od 1. do 14. janu\u00e1ra. 27. janu\u00e1ra bolo objaven\u00e9, \u017ee dan\u00fdmi commitmi sa situ\u00e1cia nekon\u010dila a \u00fatok zasiahol p\u00e4\u0165 repozit\u00e1rov projektu (plone\/volto, plone\/mockup, plone\/plone.app.mosaic, plone\/critical-css-cli, plone\/plonetheme.barceloneta), do ktor\u00fdch bol nen\u00e1padne integrovan\u00fd \u0161kodliv\u00fd k\u00f3d. V pr\u00edpade repozit\u00e1ra plone.app.mosaic sa \u00fato\u010dn\u00edkom podarilo vymeni\u0165 master vetvu. \u00datok bol vykonan\u00fd dva mesiace po zachyten\u00ed pr\u00edstupov\u00e9ho tokenu v\u00fdvoj\u00e1ra. <\/p>\n

Na integr\u00e1ciu zmien sa \u00fato\u010dn\u00edci namiesto be\u017en\u00fdch commitov vyu\u017eili oper\u00e1ciu «force push» (git push s mo\u017enos\u0165ou «—force»), ktor\u00e1 umo\u017e\u0148uje n\u00fatene nahradi\u0165 vetvu vo vonkaj\u0161om repozit\u00e1ri vlastn\u00fdm obsahom a t\u00fdm p\u00e1dom prep\u00edsa\u0165 hist\u00f3riu zmien (po nahraden\u00ed sa zobrazuje hist\u00f3ria z vetvy nahranej \u00fato\u010dn\u00edkom). Aby sa v bud\u00facnosti predi\u0161lo takejto v\u00fdmene vetiev, v\u00fdvoj\u00e1ri Plone zahrnuli do GitHub pravidl\u00e1, ktor\u00e9 blokuj\u00fa oper\u00e1cie «force push» pre hlavn\u00e9 vetvy a tagy. <\/p>\n

V repozit\u00e1ri plone.app.mosaic na s\u0165a\u017eenie identifik\u00e1cie kompromit\u00e1cie \u00fato\u010dn\u00edci vlo\u017eili do master-vetvy \u0161kodliv\u00fd commit s fikt\u00edvnym d\u00e1tumom — 18. december, domnievaj\u00fac sa, \u017ee oblas\u0165 h\u013eadania \u0161kodliv\u00e9ho k\u00f3du sa s\u00fastred\u00ed na zmeny pridan\u00e9 po ich prvej aktivite v repozit\u00e1ri. \u0160kodliv\u00e1 zmena bola v predstavenom commite prezentovan\u00e1 ako za\u010diatok v\u00fdvoja novej testovacej verzie, ale okrem zmeny \u010d\u00edsla verzie v metad\u00e1tach (z 4.0.0a1 na 4.0.0a2.dev0) bol do sp\u00fa\u0161\u0165an\u00e9ho javascript s\u00faboru‎ prettier.config.js pridan\u00fd \u0161kodliv\u00fd k\u00f3d. Aby sa pri prezeran\u00ed zmien v termin\u00e1li zakryla, bol k\u00f3d pridan\u00fd v jednej l\u00ednii s legit\u00edmnou oper\u00e1ciou a posunut\u00fd z vidite\u013enej oblasti pomocou medzier. V rozhran\u00ed GitHub sa tento k\u00f3d tie\u017e nezobrazoval predvolene a vy\u017eadoval stla\u010denie tla\u010didla «Load Diff».

\"\u00dato\u010dn\u00edkom<\/center> <\/p>\n

\u00datok bol zameran\u00fd sk\u00f4r na v\u00fdvoj\u00e1rov projektu ne\u017e na pou\u017e\u00edvate\u013eov. \u0160kodliv\u00e9 zmeny sa do vydania nedostali. \u0160kodliv\u00fd k\u00f3d sa aktivoval pri zostavovan\u00ed, na\u010d\u00edtal exploit pre zv\u00fd\u0161enie opr\u00e1vnen\u00ed, nastavil automatick\u00e9 sp\u00fa\u0161\u0165anie prostredn\u00edctvom volania svojich procesov zo sp\u00fa\u0161\u0165ac\u00edch skriptov a umo\u017enil vzdialen\u00fa spr\u00e1vu. serverom<\/a>. Okrem toho in\u0161talovan\u00fd \u0161kodliv\u00fd komponent vykon\u00e1val vyh\u013ead\u00e1vanie a posielanie citliv\u00fdch \u00fadajov, ako s\u00fa pr\u00edstupov\u00e9 toky, profily prehliada\u010dov a k\u013e\u00fa\u010de od kryptope\u0148a\u017eeniek.
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Plone, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Python \u0438 JavaScript\/NodeJS, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 GitHub \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u0418\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 \u0431\u044b\u043b\u0438 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u043f\u043e\u044f\u0432\u0438\u0432\u0448\u0438\u0445\u0441\u044f 7 \u044f\u043d\u0432\u0430\u0440\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f (1, 2, 3), \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 JavaScript-\u0444\u0430\u0439\u043b\u044b \u043f\u0440\u043e\u0435\u043a\u0442\u0430 (1, 2, 3). \u0420\u0430\u0437\u0431\u043e\u0440 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":156093,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-156092","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u00dato\u010dn\u00edkom sa podarilo prida\u0165 nepozorovan\u00fd \u0161kodliv\u00fd k\u00f3d do repozit\u00e1ra Plone | ProHoster","description":"V\u00fdvoj\u00e1ri vo\u013en\u00e9ho syst\u00e9mu na spr\u00e1vu obsahu Plone, nap\u00edsan\u00e9ho v Pythone a JavaScripte\/NodeJS, ozn\u00e1mili incident, pri ktorom bol do git-repozit\u00e1ra projektu na GitHub pridan\u00fd \u0161kodliv\u00fd k\u00f3d.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043d\u0435\u0437\u0430\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0439 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 Plone | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u043e\u043c Plone, \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Python \u0438 JavaScript\/NodeJS, \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0438 \u043e\u0431 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u0432 git-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0439 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u043d\u0430 GitHub \u0431\u044b\u043b \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/atakuyushhim-udalos-dobavit-nezamechennyj-vredonosnyj-kod-v-repozitorij-plone","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-02-01T09:11:55+00:00","article:modified_time":"2026-02-01T09:11:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"156092","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 21:49:15","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-01 09:11:56","updated":"2026-02-09 21:49:15","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/156092","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=156092"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/156092\/revisions"}],"predecessor-version":[{"id":160399,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/156092\/revisions\/160399"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/156093"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=156092"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=156092"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=156092"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}