{"id":101180,"date":"2021-09-02T22:22:53","date_gmt":"2021-09-02T20:22:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-pac-resolver-naschityvayushhem-3-mln-zagruzok-v-nedelyu"},"modified":"2021-09-02T22:22:53","modified_gmt":"2021-09-02T20:22:54","slug":"uyazvimost-v-npm-pakete-pac-resolver-naschityvayushhem-3-mln-zagruzok-v-nedelyu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-npm-pakete-pac-resolver-naschityvayushhem-3-mln-zagruzok-v-nedelyu","title":{"rendered":"Nj\u00eb vulnerabilitet n\u00eb paket\u00ebn NPM pac-resolver, e cila num\u00ebron 3 milion shkarkime \u00e7do jav\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb paket\u00ebn NPM pac-resolver, e cila ka m\u00eb shum\u00eb se 3 milion shkarkime n\u00eb jav\u00eb, \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi (CVE-2021-23406), e cila lejon realizimin e ekzekutimit t\u00eb kodit tuaj JavaScript n\u00eb kontekstin e aplikacionit gjat\u00eb d\u00ebrgimit t\u00eb k\u00ebrkesave HTTP nga projektet Node.js, q\u00eb mb\u00ebshtesin funksionin e konfigurimit automat t\u00eb serverit proxy. <\/p>\n
Paketa pac-resolver kryen p\u00ebrpunimin e skedar\u00ebve PAC, t\u00eb cil\u00ebt p\u00ebrfshijn\u00eb nj\u00eb skenar p\u00ebr automatikun e konfigurimit t\u00eb serverit proxy. Skedari PAC p\u00ebrmban kod t\u00eb zakonsh\u00ebm JavaScript me funksionin FindProxyForURL, i cili p\u00ebrcakton logjik\u00ebn e zgjedhjes s\u00eb serverit proxy n\u00eb var\u00ebsi t\u00eb hostit dhe URL-s\u00eb s\u00eb k\u00ebrkuar. Thelbi i dob\u00ebsis\u00eb \u00ebsht\u00eb se p\u00ebr ekzekutimin e k\u00ebtij kodi JavaScript n\u00eb pac-resolver \u00ebsht\u00eb p\u00ebrdorur API i ofruar n\u00eb Node.js VM, q\u00eb lejon ekzekutimin e kodit JavaScript n\u00eb nj\u00eb kontekst tjet\u00ebr t\u00eb motorit V8. <\/p>\n
Ky API \u00ebsht\u00eb sh\u00ebnuar qart\u00eb n\u00eb dokumentacion si i pap\u00ebrshtatsh\u00ebm p\u00ebr t\u00eb ekzekutuar kodin q\u00eb nuk \u00ebsht\u00eb i besuesh\u00ebm, pasi ai nuk ofron izolimin e plot\u00eb t\u00eb kodit n\u00eb ekzekutim dhe lejon aksesin n\u00eb kontekstin origjinal. Problemi \u00ebsht\u00eb zgjidhur n\u00eb l\u00ebshimin e pac-resolver 5.0.0, i cili \u00ebsht\u00eb kaluar n\u00eb p\u00ebrdorimin e bibliotek\u00ebs vm2, e cila ofron nj\u00eb nivel m\u00eb t\u00eb lart\u00eb izolimi, t\u00eb p\u00ebrshtatsh\u00ebm p\u00ebr t\u00eb ekzekutuar kodin e pa besuesh\u00ebm.
<\/center> <\/p>\n
Kur p\u00ebrdoret nj\u00eb version i cenuesh\u00ebm i pac-resolver, nj\u00eb sulmues p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb skedari PAC t\u00eb formuar posa\u00e7\u00ebrisht mund t\u00eb arrij\u00eb t\u00eb ekzekutoj\u00eb kodin e tij JavaScript n\u00eb kontekstin e kodit t\u00eb projektit q\u00eb p\u00ebrdor Node.js, n\u00ebse n\u00eb k\u00ebt\u00eb projekt p\u00ebrdoren biblioteka q\u00eb jan\u00eb t\u00eb lidhura me pac-resolver. Biblioteka m\u00eb e popullarizuar nga ato problematike \u00ebsht\u00eb Proxy-Agent, e p\u00ebrmendur n\u00eb var\u00ebsit\u00eb e 360 projekteve, p\u00ebrfshir\u00eb urllib, aws-cdk, mailgun.js dhe firebase-tools, duke arritur nj\u00eb total prej m\u00eb shum\u00eb se tre milion shkarkimeve n\u00eb jav\u00eb. <\/p>\n
N\u00ebse nj\u00eb aplikacion q\u00eb \u00ebsht\u00eb n\u00eb var\u00ebsi me pac-resolver ngarkon nj\u00eb skedar PAC, q\u00eb ofrohet nga nj\u00eb sistem mb\u00ebshtet\u00ebs t\u00eb protokollit WPAD p\u00ebr konfigurimin automatik t\u00eb serverit proxy, at\u00ebher\u00eb p\u00ebr t\u00eb inkorporuar skedar\u00ebt PAC t\u00eb d\u00ebmsh\u00ebm, sulmuesit q\u00eb kan\u00eb qasje n\u00eb rrjetin lokal mund t\u00eb shfryt\u00ebzojn\u00eb shp\u00ebrndarjen e parametrave t\u00eb serverit proxy p\u00ebrmes DHCP. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Nj\u00eb](\"\/wp-content\/uploads\/2021\/09\/3c16ba59e1b3371e326a44486d8332df.png\")
<\/center> <\/p>\n