{"id":183985,"date":"2026-10-24T23:40:31","date_gmt":"2026-10-24T21:40:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/kriticheskaya-uyazvimost-v-dekodirovshhike-brotli-zatragivayushhaya-node-js-bun-brauzery-http-klienty-i-drugie-proekty"},"modified":"2026-10-24T23:40:36","modified_gmt":"2026-10-24T21:40:36","slug":"critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/critical-vulnerability-in-the-brotli-decoder-affecting-node-js-bun-browsers-http-clients-and-other-projects","title":{"rendered":"Kritick\u00e1 zranite\u013enos\u0165 v dekod\u00e9ri Brotli, ktor\u00e1 sa t\u00fdka Node.JS, Bun, prehliada\u010dov, HTTP klientov a in\u00fdch projektov","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
V kni\u017enici s referen\u010dnou implement\u00e1ciou dekod\u00e9ra pre form\u00e1t kompresie d\u00e1t Brotli bola zisten\u00e1 zranite\u013enos\u0165 (CVE-2026-111497, k\u00f3dov\u00e9 men\u00e1 Broccoli2Shell a HTTP2Shell), ktor\u00e1 vedie k prete\u010deniu z\u00e1sobn\u00edka pri spracovan\u00ed \u0161peci\u00e1lne upraven\u00fdch komprimovan\u00fdch d\u00e1t. Pod\u013ea Google m\u00f4\u017ee by\u0165 zranite\u013enos\u0165 vyu\u017eit\u00e1 na vzdialen\u00e9 vykon\u00e1vanie k\u00f3du pri \u00fatoku na projekty, ktor\u00e9 pou\u017e\u00edvaj\u00fa ofici\u00e1lnu implement\u00e1ciu dekod\u00e9ra Brotli. Medzi ovplyvnen\u00e9 projekty patr\u00ed: Node.js, Bun, Envoy, Istio, webov\u00e9 prehliada\u010de, proxy servery, HTTP klienti, HTTP servery, arch\u00edvovacie n\u00e1stroje, proxy servery, UEFI firmv\u00e9ry, prehliada\u010de JPEG XL, dekoduj\u00face kni\u017enice pre Python, Ruby, Java, PHP a .NET a s\u00favisiace z\u00e1vislosti. <\/p>\n
Probl\u00e9m bol identifikovan\u00fd spolo\u010dnos\u0165ou OpenAI vo febru\u00e1ri tohto roku a bol blokovan\u00fd v k\u00f3dovej b\u00e1ze Brotli prostredn\u00edctvom odmietania nespr\u00e1vnych toku pri dek\u00f3dovan\u00ed. 22. okt\u00f3bra boli uverejnen\u00e9 opravn\u00e9 verzie Brotli 1.0.10, 1.1.1 a 1.2.1, v ktor\u00fdch bolo explicitne uveden\u00e9 o odstr\u00e1nen\u00ed zranite\u013enosti a vyrie\u0161en\u00ed podstaty probl\u00e9mu. V ten ist\u00fd de\u0148 bol vytvoren\u00fd prototyp exploit, ktor\u00fd umo\u017enil vzdialene vykona\u0165 k\u00f3d v laborat\u00f3rnych podmienkach pri pou\u017eit\u00ed ne\u0161tandardn\u00fdch zost\u00e1v (v \u0161tandardn\u00fdch zostav\u00e1ch do\u0161lo k hav\u00e1rii). N\u00e1sledne spolo\u010dnos\u0165 Imperva zaznamenala \u00fatok na \u0161tandardn\u00e9 zostavy Node.js 24.22.0 v prostred\u00ed Linux na syst\u00e9me ARM64.<\/p>\n
Zranite\u013enos\u0165 vedie k z\u00e1pisu mimo z\u00e1sobn\u00edk v d\u00f4sledku nespr\u00e1vneho spracovania ch\u00fdb po\u010das rozl\u00fa\u0161tenia blokov v komprimovanom pr\u00fade. Funkcia DecodeBlockTypeAndLength() namiesto k\u00f3du chyby vracala iba hodnoty true a false, \u010do neumo\u017e\u0148ovalo volaj\u00facemu k\u00f3du odl\u00ed\u0161i\u0165 po\u0161kodenie pr\u00fadu od stavu, ktor\u00fd vy\u017eaduje prenos \u010fal\u0161\u00edch \u00fadajov do funkcie. V pr\u00edpade, \u017ee pr\u00fad obsahuje nespr\u00e1vny typ bloku komprimovan\u00fdch d\u00e1t, dekod\u00e9r ho vn\u00edmal nielen ako chybu, ale aj ako stav nedostatku \u00fadajov, ktor\u00fd vy\u017eaduje \u010fal\u0161ie \u010d\u00edtanie z pr\u00fadu. Ke\u010f\u017ee vyhraden\u00fd z\u00e1sobn\u00edk v\u0161ak nebol vypo\u010d\u00edtan\u00fd na dodato\u010dne pre\u010d\u00edtan\u00e9 \u00fadaje, boli zap\u00edsan\u00e9 do oblasti za jeho hranicami, kde sa uchov\u00e1val vn\u00fatorn\u00fd stav dekod\u00e9ra.<\/p>\n
Referen\u010dn\u00e1 kni\u017enica brotli, probl\u00e9m sa prejavuje od vydania 1.0.3 a bol odstr\u00e1nen\u00fd v aktualiz\u00e1ci\u00e1ch 1.0.10, 1.1.1 a 1.2.1. Zranite\u013enos\u0165 sa t\u00fdka aplik\u00e1ci\u00ed a kni\u017en\u00edc pou\u017e\u00edvaj\u00facich kni\u017enicu libbrotlidec.\n
Platforma Node.js JavaScript, probl\u00e9m s \u00fatokmi bol odstr\u00e1nen\u00fd v aktualiz\u00e1ci\u00e1ch 26.12.1, 24.22.1 a 22.23.4. M\u00f4\u017eu by\u0165 napadnut\u00e9 aplik\u00e1cie, ktor\u00e9 pou\u017e\u00edvaj\u00fa na volanie extern\u00e9ho obsahu met\u00f3du fetch(), ktor\u00e1 automaticky dek\u00f3duje HTTP odpovede so z\u00e1hlav\u00edm \u201eContent-Encoding: br\u201c. Zranite\u013enos\u0165 sa prejavuje aj pri priamom volan\u00ed met\u00f3d zlib.brotliDecompress*(), createBrotliDecompress() a brotli.decompress() na rozbalenie extern\u00e9ho obsahu alebo pri prij\u00edman\u00ed HTTP po\u017eiadaviek s anal\u00fdzou prostredn\u00edctvom kni\u017en\u00edc Express 5 a body-parser 2.x.\n
Python bal\u00edky brotli a brotlicffi (oprava navrhnut\u00e1 vo verzii 1.2.1) a projekty, ktor\u00e9 ich pou\u017e\u00edvaj\u00fa, medzi ktor\u00fdmi s\u00fa popul\u00e1rne kni\u017enice urllib3, aiohttp, httpx a Scrapy, ktor\u00e9 dek\u00f3duj\u00fa odpovede so z\u00e1hlav\u00edm \u201eContent-Encoding: br\u201c pri pr\u00edstupe k vonkaj\u0161\u00edm webov\u00fdm zdrojom.\n
HTTP servery, HTTP proxy, HTTP klienti a webov\u00e9 prehliada\u010de, ktor\u00e9 podporuj\u00fa kompresiu Brotli (\u201eAccept-Encoding: br\u201c). V Apache httpd sa dod\u00e1va mod_brotli (vypnut\u00e9 predvolene). Pre nginx je k dispoz\u00edcii extern\u00fd modul ngx_brotli (verzia brotli v z\u00e1vislostiach bola zv\u00fd\u0161en\u00e1 na aktu\u00e1lnu). V Chrome\/Chromium a Firefox bol probl\u00e9m u\u017e odstr\u00e1nen\u00fd v niektorej z predch\u00e1dzaj\u00facich aktualiz\u00e1ci\u00ed. V proxy-serveri<\/a> Zranite\u013enos\u0165 Envoy bola odstr\u00e1nen\u00e1 v verzi\u00e1ch 1.40.0, 1.39.3, 1.38.6, 1.37.8, 1.36.12.\n