{"id":101180,"date":"2021-09-02T22:22:53","date_gmt":"2021-09-02T20:22:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-pac-resolver-naschityvayushhem-3-mln-zagruzok-v-nedelyu"},"modified":"2021-09-02T22:22:53","modified_gmt":"2021-09-02T20:22:54","slug":"uyazvimost-v-npm-pakete-pac-resolver-naschityvayushhem-3-mln-zagruzok-v-nedelyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-pac-resolver-naschityvayushhem-3-mln-zagruzok-v-nedelyu","title":{"rendered":"Vulnerabilitet n\u00eb paket\u00ebn NPM pac-resolver, q\u00eb ka 3 milion shkarkime n\u00eb jav\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb paket\u00ebn NPM pac-resolver, e cila ka mbi 3 milion shkarkime n\u00eb jav\u00eb, \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2021-23406) q\u00eb lejon ekzekutimin e kodit tuaj JavaScript n\u00eb kontekstin e aplikacionit gjat\u00eb d\u00ebrgimit t\u00eb k\u00ebrkesave HTTP nga projektet Node.js q\u00eb mb\u00ebshtesin funksionin e konfigurimit automatik t\u00eb proxy-t. <\/p>\n
Paketa pac-resolver analiz\u00ebn e skedar\u00ebve PAC, t\u00eb cil\u00ebt p\u00ebrfshijn\u00eb nj\u00eb skenar t\u00eb konfigurimit automatik t\u00eb proxy-t. Skedari PAC p\u00ebrmban kod t\u00eb zakonsh\u00ebm JavaScript me funksionin FindProxyForURL, i cili p\u00ebrcakton logjik\u00ebn e zgjedhjes s\u00eb proxy-t n\u00eb var\u00ebsi t\u00eb hostit dhe URL-s\u00eb s\u00eb k\u00ebrkuar. Thelbi i dob\u00ebsis\u00eb \u00ebsht\u00eb se p\u00ebr t\u00eb ekzekutuar k\u00ebt\u00eb kod JavaScript n\u00eb pac-resolver u p\u00ebrdor API-ja e ofruar n\u00eb Node.js VM, e cila lejon ekzekutimin e kodit JavaScript n\u00eb nj\u00eb kontekst tjet\u00ebr t\u00eb motorit V8. <\/p>\n
Ky API \u00ebsht\u00eb sh\u00ebnuar qart\u00eb n\u00eb dokumentacion si jo i destinuar p\u00ebr ekzekutimin e kodit t\u00eb pa besuesh\u00ebm, pasi nuk ofron izolim t\u00eb plot\u00eb t\u00eb kodit t\u00eb ekzekutuar dhe lejon qasje n\u00eb kontekstin origjinal. Problemi \u00ebsht\u00eb zgjidhur n\u00eb l\u00ebshimin e pac-resolver 5.0.0, i cili \u00ebsht\u00eb kaluar n\u00eb p\u00ebrdorimin e bibliotek\u00ebs vm2, e cila ofron nj\u00eb nivel m\u00eb t\u00eb lart\u00eb izolimi, n\u00eb p\u00ebrputhje me ekzekutimin e kodit t\u00eb pa besuesh\u00ebm.
<\/center> <\/p>\n
N\u00ebse p\u00ebrdoret versione e rrezikshme e pac-resolver, nj\u00eb sulmues p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb skedari PAC t\u00eb formatuar ve\u00e7mas mund t\u00eb arrij\u00eb ekzekutimin e kodit t\u00eb tij JavaScript n\u00eb kontekstin e kodit t\u00eb projektit q\u00eb p\u00ebrdor Node.js, n\u00ebse n\u00eb k\u00ebt\u00eb projekt p\u00ebrdoren biblioteka q\u00eb kan\u00eb var\u00ebsira me pac-resolver. Nj\u00eb nga bibliotekat m\u00eb t\u00eb njohura me probleme \u00ebsht\u00eb Proxy-Agent, e cila \u00ebsht\u00eb e listuar n\u00eb var\u00ebsit\u00eb e 360 projekteve, duke p\u00ebrfshir\u00eb urllib, aws-cdk, mailgun.js dhe firebase-tools, me gjithsej mbi tre milion shkarkime n\u00eb jav\u00eb. <\/p>\n
N\u00ebse aplikacioni q\u00eb lidhet me var\u00ebsit\u00eb me pac-resolver ngarkon nj\u00eb skedar PAC, i ofruar nga nj\u00eb sistem q\u00eb mb\u00ebshtet protokollin e konfigurimit automatik t\u00eb proxy-t WPAD, sulmuesit q\u00eb kan\u00eb akses n\u00eb rrjetin lokal mund t\u00eb p\u00ebrfitojn\u00eb nga shp\u00ebrndarja e cil\u00ebsimeve t\u00eb proxy-t p\u00ebrmes DHCP p\u00ebr t\u00eb futur skedar\u00eb PAC t\u00eb d\u00ebmsh\u00ebm. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Vulnerabilitet](\"\/wp-content\/uploads\/2021\/09\/3c16ba59e1b3371e326a44486d8332df.png\")
<\/center> <\/p>\n