{"id":163792,"date":"2026-03-10T23:11:57","date_gmt":"2026-03-10T21:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy"},"modified":"2026-03-10T23:11:57","modified_gmt":"2026-03-10T21:11:59","slug":"uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","title":{"rendered":"Ranjivosti u projektu Pingora, koje omogu\u0107avaju ubacivanje u sporedne zahteve","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Podjetje Cloudflare je napovedalo odpravo treh ranljivosti v okviru Pingora, od katerih sta dve ocenjeni kot kriti\u010dni (9,3 od 10). Okvir Pingora je napisan v programskem jeziku Rust in je namenjen razvoju za\u0161\u010ditenih, visokozmogljivih omre\u017enih storitev. Proksi, zgrajen s pomo\u010djo Pingora, se uporablja v omre\u017eju za dostavo vsebin Cloudflare in obdeluje ve\u010d kot 40 milijonov zahtevkov na sekundo. Ranljivosti so odpravljene v izdaji Pingora 0.8.0. <\/p>\n

Dve najbolj nevarne ranljivosti omogo\u010dajo napade vrste «HTTP Request Smuggling», ki omogo\u010dajo obvoz sistemov omejevanja dostopa in vstavitev v vsebino zahtevkov drugih uporabnikov, obdelanih v isti zanki med front-endom in back-endom (na primer, za vstavljanje zlonamernega JavaScript-kode v sejo drugega uporabnika s spletnim mestom). Te te\u017eave je odkril udele\u017eenec programa Bug Bounty, ki predvideva izpla\u010dilo nagrade za odkrivanje ranljivosti. <\/p>\n

V shemi, kjer se dostopa do back-enda prek obratnega proxyja, zahteve strank sprejema dodatna vozli\u0161\u010de, ki vzpostavi dolgotrajno TCP-povezavo s back-endom, ki neposredno obdeluje zahteve. Preko te skupne povezave se obi\u010dajno prena\u0161ajo zahteve razli\u010dnih uporabnikov, ki sledijo po verigi ena za drugo z lo\u010devanjem s sredstvi protokola HTTP. Napadi vrste HTTP Request Smuggling nastanejo zaradi razli\u010dne interpretacije HTTP-klju\u010dev in specifikacij protokola HTTP na front-endih in back-endih, na primer, ko front-end uporablja za dolo\u010danje velikosti zahtevka HTTP-klju\u010d «Content-Length», back-end pa «Transfer-Encoding: chunked». <\/p>\n

Prva ranljivost CVE-2026-2835 se pojavi v kodi za raz\u010dlenjevanje zahtev HTTP\/1.0 in je posledica nepravilne obdelave klju\u010da «Transfer-Encoding» s ve\u010d vrednostmi, prav tako pa tudi uporabe zaprtja povezave kot znaka konca telesa zahtevka (close-delimited). Pingora je preverjal le razli\u010dico «Transfer-Encoding: chunked» in ignoriral ta klju\u010d, \u010de je v njem bilo navedeno ve\u010d vrednosti. V tej situaciji Pingora ni upo\u0161teval velikosti v klju\u010du «Content-Length», temve\u010d je kot telo zahtevka \u0161telo vse podatke, prejele do zaprtja povezave. <\/p>\n

Z navedbo ve\u010d vrednosti v klju\u010du «Transfer-Encoding» je napadalec lahko ustvaril pogoje, pri katerih se je na back-end preusmeril zahtevek, katerega dejanska velikost ni bila v skladu z velikostjo chunked-verige, izra\u010dunano na podlagi klju\u010da «Transfer-Encoding». Pingora je preusmeril vse prejete podatke kot en zahtevek, back-end, na primer, Node.js, pa je izra\u010dunal zahtevek na podlagi «Transfer-Encoding: chunked» in preostali del obdeloval kot za\u010detek drugega zahtevka. GET \/ HTTP\/1.0 Host: example.com Connection: keep-alive Transfer-Encoding: identity, chunked Content-Length: 29 0 GET \/admin HTTP\/1.1 X:

\"Ranjivosti<\/center> <\/p>\n

Druga ranljivost CVE-2026-2833 je posledica nepravilne obrade HTTP zaglavlja «Upgrade» u HTTP\/1.1 zahtevima. Kada je zaglavlje «Upgrade» prisutno u zahtevu, proksi odmah prosledi preostale podatke zahteva ka backendu, ne \u010dekaju\u0107i odgovor od backenda sa kodom 101 (Switching Protocols). Zbog toga je sinhronizacija toka izme\u0111u proksija i backenda bila naru\u0161ena, a backend je primao podatke poslata nakon zaglavlja «Upgrade» kao poseban zahtev i slao rezultat tog zahteva kao odgovor na posle pristigli zahtev drugog korisnika. GET \\\/ HTTP\\\/1.1 Host: example.com Upgrade: foo GET \\\/admin HTTP\\\/1.1 Host: example.com

\"Ranjivosti<\/center>
\"Ranjivosti<\/center> <\/p>\n

Problemi se javljaju prilikom kori\u0161\u0107enja Pingora kao obrnutog proksija (ingress proxy), koji preusmerava korisni\u010dke zahteve ka backendima koriste\u0107i protokole HTTP\/1.0 ili HTTP\/1.1. Konfiguracija Pingora u mre\u017ei za isporuku sadr\u017eaja Cloudflare nije dozvolila iskori\u0161\u0107avanje ranljivosti, budu\u0107i da Pingora u CDN-u ne funkcioni\u0161e kao ingress-proxy, preusmerava zahteve isklju\u010divo kori\u0161\u0107enjem protokola HTTP\/1.1, blokira zahteve sa nepravilnim vrednostima Content-Length, preusmerava samo jednu vrednost zaglavlja «Transfer-Encoding: chunked» i dodaje u zahteve sa zaglavljem «Upgrade:» dodatno zaglavlje «Connection: close», koje onemogu\u0107ava prosle\u0111ivanje dodatnih zahteva u istom konekciji. <\/p>\n

Tre\u0107a ranljivost CVE-2026-2836 (stepen opasnosti 8.4 od 10) dovodi do trovanja ke\u0161om (cache poisoning) usled generisanja klju\u010da za sme\u0161taj podataka u ke\u0161u (CacheKey) isklju\u010divo na osnovu putanje iz URI, ignori\u0161u\u0107i sadr\u017eaj zaglavlja «Host». Ova nedostatak dovodi do stvaranja identi\u010dnih klju\u010deva ke\u0161iranja za iste HTTP putanje razli\u010ditih hostova. Ranljivost se mo\u017ee iskoristiti za zamenu sadr\u017eaja ke\u0161a kada se koristi ke\u0161iranje za vi\u0161e hostova. U Pingora, ke\u0161iranje je eksperimentalna funkcija koja se ne preporu\u010duje za produkciona re\u0161enja.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Pingora, \u0434\u0432\u0443\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10). \u0424\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a Pingora \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432. \u041f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Pingora \u043f\u0440\u043e\u043a\u0441\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Cloudflare \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 40 \u043c\u043b\u043d \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432 \u0441\u0435\u043a\u0443\u043d\u0434\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":163793,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-163792","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ranljivosti v projektu Pingora, ki omogo\u010dajo vsiljevanje v tuje poizvedbe | ProHoster","description":"Podjetje Cloudflare je napovedalo odpravo treh ranljivosti v okviru Pingora, pri \u010demer sta dvema dodeljena kriti\u010dna stopnja nevarnosti (9.3 od 10).","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0435 Pingora, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u043a\u043b\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Pingora, \u0434\u0432\u0443\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10).","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-10T21:11:59+00:00","article:modified_time":"2026-03-10T21:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/163792","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=163792"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/163792\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/163793"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=163792"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=163792"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=163792"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}