75 faʻafitauli faʻapipiʻi i le Magento e-commerce platform

I totonu o se tulaga tatala mo le faʻatulagaina o le e-commerce Magento, lea e fa'atatau 20% maketi o faiga mo le fatuina o faleoloa i luga ole laiga, faaalia faʻafitauli, o le tuʻufaʻatasia o ia mea e mafai ai ona e faia se osofaʻiga e faʻatino lau code i luga o le 'auʻaunaga, maua le pule atoatoa ile faleoloa i luga ole laiga ma faʻatulagaina le toe faʻaleleia o tupe totogi. Fa'aletonu aveesea i Magento faʻasaʻo 2.3.2, 2.2.9 ma 2.1.18, lea faʻatasi faʻamautu 75 mataupu saogalemu.

E tasi le mataupu e mafai ai e se tagata e le faʻamaoniaina ona ausia le faʻaogaina o le JavaScript (XSS) e mafai ona faʻatinoina pe a vaʻai i le faʻaleaogaina o faʻatauga faʻatau i totonu o le admin interface. O le ute o le faʻafitauli o le mafai lea ona pasia le faʻamamaina o tusitusiga e faʻaaoga ai le escapeHtmlWithLinks () galuega pe a faʻagasolo se faʻamatalaga i le fomu faʻaleaogaina i luga o le siaki siaki (faʻaaogaina le "a href=http://onmouseover=..." tag faamoega i se isi pine). O le faʻafitauli e faʻaalia pe a faʻaaogaina le faʻaogaina o le Authorize.Net module, lea e faʻaaogaina e talia ai le totogiina o aitalafu.

Ina ia maua le pule atoatoa i le faʻaaogaina o le code JavaScript i le tulaga o le taimi nei o se tagata faigaluega faleoloa, o se faʻafitauli lona lua o loʻo faʻaaogaina, lea e mafai ai ona e utaina se faila faila i lalo o le foliga o se ata (ta'ita'i osofa'iga "Phar deserialization"). O le faila Phar e mafai ona faʻapipiʻiina e ala i le faʻapipiʻiina o ata i totonu o le faʻatonu WYSIWYG ua fausia. I le ausiaina o le faʻataunuʻuina o lana PHP code, e mafai e le tagata osofaʻi ona suia faʻamatalaga totogi poʻo le faʻalavelaveina o faʻamatalaga pepa aitalafu.

O le mea e malie ai, o faʻamatalaga e uiga i le XSS faʻafitauli na tuʻuina atu i le au atinaʻe Magento i tua ia Setema 2018, ina ua maeʻa ona tuʻuina atu se patch i le faaiuga o Novema, lea, e pei ona i ai, e faʻaumatia na o se tasi o mataupu faʻapitoa ma faigofie ona faʻafefe. Ia Ianuari, na lipotia mai ai foi e mafai ona sii mai se faila Phar i lalo o le foliga o se ata ma faʻaalia ai pe faʻapefea ona faʻaogaina se tuʻufaʻatasiga o faʻafitauli e lua e faʻafefe ai faleoloa i luga ole laiga. I le faaiuga o Mati i Magento 2.3.1,
2.2.8 ma le 2.1.17 na faʻamautuina le faʻafitauli i faila a Phar, ae galo le XSS faʻaleleia, e ui lava na tapunia le pepa faʻasalalau. Ia Aperila, na toe faʻaauau le faʻavasegaina o le XSS ma faʻamautu le mataupu i faʻasalalauga 2.3.2, 2.2.9, ma le 2.1.18.

E tatau ona maitauina o nei faʻasalalauga e faʻaleleia ai le 75 faʻafitauli, 16 o loʻo faʻamauina e taua, ma 20 mataupu e mafai ona taʻitaʻia ai le PHP code execution poʻo le sui SQL. Ole tele o fa'afitauli ogaoga e na'o se tagata fa'aoga fa'amaonia e mafai ona faia, ae pei ona fa'aalia i luga, e faigofie lava ona ausia fa'atinoga fa'amaonia ile fa'aogaina ole XSS fa'aletonu, lea e tele taseni na fa'apipi'iina i fa'amaumauga fa'amau.

puna: opennet.ru