Kusagadzikana kwakanyanya kwaonekwa muCloudflare's cdnjs content delivery network, iyo yakagadzirirwa kukurumidzira kuendeswa kwemaraibhurari eJavaScript, zvichibvumira kutongerwa kodhi kuuraya pamaseva eCDN. Ngozi yedambudziko iri kuwedzeredzwa nenyaya yekuti ingangoita 12.7% yemasaiti ese paInternet anoshandisa sevhisi kurodha JavaScript raibhurari, uye kukanganisa kwezvivakwa kunoita kuti zvibvire kutsiva maraibhurari akapihwa neimwe yemasaiti aya.
Iyo cdnjs sevhisi inodhawunirodha mapakeji kubva kuGit kana NPM repository, mushure mezvo inobvumira chero saiti kushandisa Cloudflare yemukati yekutumira network yemahara kukurumidza kurodha mumaraibhurari eJavaScript. Paunenge uchidzidza kodhi ye cdnjs zvikamu zvakaburitswa paGitHub, zvakaratidzwa kuti kuburitsa NPM mapakeji mutgz archives, yakajairwa archive/tar module mumutauro weGo inoshandiswa, iyo inoburitsa runyoro rwemafaira sezvaari, pasina nzira yekujairira. Kana iyo script inoburitsa zvirimo zvichienderana nerondedzero yakapihwa, kuvapo mudura remafaira senge "../../../../../../../tmp/test" kunogona tungamira mukupenengura mafaera musystem, sekusvika kodzero dzekuwana dzinobvumidza.
Zvakakurudzirwa kuti munhu anorwisa anogona kunyorera kuti awedzere raibhurari yake ku cdnjs uye kurodha yakanyatsogadzirirwa dura rine mafaera ane "../" mavara munzira inoenda kuNPM repository. Pamaseva e cdnjs, "autoupdate" mashandiro anoitwa nguva nenguva, panguva iyo mubati anorodha zvinyorwa zvitsva zveraibhurari yakarongwa uye anoburitsa zviri mukati. Uchishandisa mafaera ane nzira β../β, munhu anorwisa anogona kunyora pamusoro mafaera aine masevhisi zvinyorwa uye oita kodhi yavo pane sevha iyo yakavhurwa.
Panyaya yekudhawunirodha zvidzoreso kubva kuGit, zvakaonekwa kuti mubatiri wekurodha zvidzoreso haana kufunga maratidziro ekufananidzira pakukopa mafaera kubva kuGit. Iyi ficha yakaita kuti zvikwanise kuronga kuverenga kwechero mafaera kubva kuseva nekuwedzera ekufananidzira zvinongedzo kuGit.
Zvakasarudzwa kutanga zviedzo nekuratidzira kwekubira cdnjs kuti ugamuchire mubairo paHackerOne nekuyedza fungidziro ine chekuita nekuverenga faira. Yekufananidzira yekubatanidza test.js yakawedzerwa kuGit repository yeJavaScript raibhurari inoshandiswa kuburikidza neCDN, inongedza kune /proc/self/maps faira. Mushure mekuburitsa vhezheni itsva yeraibhurari, mugadziri wekuvandudza akagadzirisa iyi repository uye akaburitsa iyo yakatarwa faira mu cdnjs (test.js yakagadzirwa sechinhu chinofananidzira chinongedzo uye kana faira iri rakumbirwa, zviri mukati me /proc/self/mepu zvakadzoserwa. )
Kutsiva chinongedzo chekufananidzira kufaira /proc/self/environ, munyori wechidzidzo ichi akaona kuti data rakapihwa raive nehunhu hwezvakasiyana siyana GITHUB_REPO_API_KEY uye WORKERS_KV_API_TOKEN. Musiyano wekutanga wakachengeta kiyi yeAPI yekunyora kupinda kune robocdnjs repository paGitHub. Yechipiri shanduko yakachengeta chiratidzo kune KV kuchengetedza mu cdnjs. Uchishandisa ruzivo rwakagamuchirwa, anorwisa anogona kuita shanduko kune cdnjs uye kukanganisa zvachose zvivakwa.
Source: opennet.ru