{"id":100603,"date":"2021-06-25T22:22:49","date_gmt":"2021-06-25T20:22:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-store-kde-org-i-katalogah-opendesktop"},"modified":"2021-06-25T22:22:49","modified_gmt":"2021-06-25T20:22:49","slug":"uyazvimost-v-store-kde-org-i-katalogah-opendesktop","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-store-kde-org-i-katalogah-opendesktop","title":{"rendered":"Dob\u00ebsia n\u00eb store.kde.org dhe katalog\u00ebt OpenDesktop","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb katalog\u00ebt e aplikacioneve q\u00eb jan\u00eb nd\u00ebrtuar mbi platform\u00ebn Pling, \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet q\u00eb lejon kryerjen e nj\u00eb sulmi XSS p\u00ebr t\u00eb ekzekutuar kodin JavaScript n\u00eb kontekstin e p\u00ebrdoruesve t\u00eb tjer\u00eb. K\u00ebto faqe jan\u00eb t\u00eb prekurit, si store.kde.org, appimagehub.com, gnome-look.org, xfce-look.org dhe pling.com. <\/p>\n
The essence of the problem is that the Pling platform allows for the addition of multimedia blocks in HTML format, for example, to embed a YouTube video or an image. The code added through the form is not properly verified, which allows for the insertion of code like «<img src="x" onerror="alert(1)">» and to place information in the directory that will execute JavaScript code upon viewing. If the information is opened by users with an account, it can initiate actions in the directory on behalf of that user, including adding a JavaScript call to their pages, creating a type of network worm. <\/p>\n
P\u00ebr m\u00eb tep\u00ebr, \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet n\u00eb aplikimin PlingStore, i nd\u00ebrtuar me platform\u00ebn Electron, i cili lejon navigimin n\u00eb katalog\u00ebt OpenDesktop pa shfletues dhe instalimin e paketave t\u00eb paraqitura aty. Vulnerabiliteti n\u00eb PlingStore lejon ekzekutimin e kodit t\u00eb p\u00ebrdoruesit n\u00eb sistemin e tij. Gjat\u00eb funksionimit t\u00eb aplikacionit PlingStore, procesi ocs-manager aktivizohet gjithashtu, i cili pranon lidhje lokale p\u00ebrmes WebSocket dhe ekzekuton komanda, si shkarkimi dhe nisja e aplikacioneve n\u00eb formatin AppImage. Supozohet se komandat d\u00ebrgohen nga aplikacioni PlingStore, por n\u00eb t\u00eb v\u00ebrtet\u00eb, p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb autentifikimit, nj\u00eb k\u00ebrkes\u00eb p\u00ebr ocs-manager mund t\u00eb d\u00ebrgohet edhe nga shfletuesi i p\u00ebrdoruesit. N\u00ebse nj\u00eb p\u00ebrdorues hap nj\u00eb faqe t\u00eb d\u00ebmshme, ai mund t\u00eb inicializoj\u00eb nj\u00eb lidhje me ocs-manager dhe t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kod n\u00eb sistemin e p\u00ebrdoruesit. <\/p>\n
Po ashtu, raportohen probleme XSS n\u00eb katalogun extensions.gnome.org \u2014 n\u00eb fush\u00ebn e URL-t\u00eb t\u00eb faqes kryesore t\u00eb shtes\u00ebs mund t\u00eb futet kodi JavaScript n\u00eb form\u00ebn \u2018javascript: kodi\u2019 dhe me klikimin mbi lidhjen, n\u00eb vend q\u00eb t\u00eb hapet faqja e projektit, do t\u00eb ekzekutohet ky JavaScript. Nga nj\u00ebra an\u00eb, problemi \u00ebsht\u00eb m\u00eb shum\u00eb teori, pasi vendosja n\u00eb katalogun extensions.gnome.org kalon nj\u00eb proces moderimi dhe p\u00ebr t\u00eb realizuar nj\u00eb sulm k\u00ebrkohet jo vet\u00ebm hapja e nj\u00eb faqe specifike, por edhe nj\u00eb klik i drejtp\u00ebrdrejt\u00eb mbi lidhjen. Nga ana tjet\u00ebr, nuk p\u00ebrjashtohet q\u00eb gjat\u00eb kontrollit, moderatorit t'i k\u00ebrkohet t\u00eb vizitoj\u00eb faqen e projektit, t\u00eb mos v\u00ebrej\u00eb formatin e lidhjes dhe t\u00eb aktivizoj\u00eb kodin JavaScript n\u00eb kontekstin e llogaris\u00eb s\u00eb tij. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"