{"id":101551,"date":"2021-10-06T04:22:36","date_gmt":"2021-10-06T02:22:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta"},"modified":"2021-10-06T04:22:36","modified_gmt":"2021-10-06T02:22:36","slug":"uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","title":{"rendered":"Vulnerabilitet n\u00eb serverin http Apache 2.4.49, i cili lejon marrjen e skedar\u00ebve jasht\u00eb rr\u00ebnj\u00ebs s\u00eb sitit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb nj\u00eb situat\u00eb emergjente \u00ebsht\u00eb formuar nj\u00eb p\u00ebrdit\u00ebsim i serverit http Apache 2.4.50, n\u00eb t\u00eb cilin \u00ebsht\u00eb eliminuar nj\u00eb vulnerabilitet 0-day (CVE-2021-41773) q\u00eb \u00ebsht\u00eb p\u00ebrdorur aktivisht, duke lejuar aksesin n\u00eb skedar\u00ebt jasht\u00eb katalogut rr\u00ebnj\u00eb t\u00eb faqes. Me an\u00eb t\u00eb k\u00ebtij vulnerabiliteti mund t\u00eb ngarkohet \u00e7do skedar sistemik dhe kod burimi i skripteve web, q\u00eb jan\u00eb t\u00eb lexuesh\u00ebm nga p\u00ebrdoruesi n\u00ebn t\u00eb cilin funksionon serveri http. Zhvilluesit u njoftuan p\u00ebr problemin m\u00eb 17 Shtator, por arrit\u00ebn t\u00eb publikojn\u00eb p\u00ebrdit\u00ebsimin vet\u00ebm sot, pas raportimit t\u00eb rasteve t\u00eb p\u00ebrdorimit t\u00eb vulnerabilitetit p\u00ebr sulmin ndaj faqeve. <\/p>\n

Rreziku i vulnerabilitetit zbutet nga fakti q\u00eb problemi shfaqet vet\u00ebm n\u00eb versionin e sapo publikuar 2.4.49 dhe nuk preku t\u00eb gjitha versionet e m\u00ebparshme. N\u00eb deg\u00ebt stabile t\u00eb shp\u00ebrndarjeve konservatore t\u00eb server\u00ebve, versioni 2.4.49 nuk \u00ebsht\u00eb p\u00ebrdorur ende (Debian, RHEL, Ubuntu, SUSE), por problemi ka prekur shp\u00ebrndarjet q\u00eb p\u00ebrdit\u00ebsohen vazhdimisht, si Fedora, Arch Linux dhe Gentoo, si dhe portet e FreeBSD. <\/p>\n

Vulnerabiliteti \u00ebsht\u00eb shkaktuar nga nj\u00eb gabim t\u00eb cilin e sjell rishikimi i kodit p\u00ebr normalizimin e rrug\u00ebve n\u00eb URI, i cili b\u00ebri q\u00eb karakteri i koduar me sekuenc\u00ebn '' n\u00eb rrug\u00eb t\u00eb mos normalizohej, n\u00ebse nj\u00eb pik\u00eb tjet\u00ebr e paraprinte at\u00eb. K\u00ebshtu, u b\u00eb e mundur q\u00eb t\u00eb p\u00ebrfshiheshin karaktere t\u00eb pastra '..\/' n\u00eb rrug\u00ebn rezultat, p\u00ebrmes nj\u00eb k\u00ebrkese q\u00eb p\u00ebrmbante sekuenc\u00ebn '.\/'. P\u00ebr shembull, nj\u00eb k\u00ebrkes\u00eb si 'https:\/\/example.com\/cgi-bin\/.\/.\/.\/.\/etc\/passwd' ose 'https:\/\/example.com\/cgi-bin\/.\/\/\/\/etc\/hosts' lejonte aksesin n\u00eb p\u00ebrmbajtjen e skedarit '\/etc\/passwd'. <\/p>\n

Problemi nuk shfaqet, n\u00ebse akseset n\u00eb katalog\u00ebt e ndaluara shprehimisht p\u00ebrmes konfigurimit 'require all denied'. P\u00ebr shembull, p\u00ebr t\u00eb ofruar nj\u00eb mbrojtje t\u00eb pjesshme, mund t\u00eb specifikohet n\u00eb skedarin e konfigurimit: require all denied <\/p>\n

N\u00eb versionin Apache httpd 2.4.50 \u00ebsht\u00eb eliminuar gjithashtu nj\u00eb tjet\u00ebr vulnerabilitet (CVE-2021-41524), q\u00eb prek modulin e implementimit t\u00eb protokollit HTTP\\\/2. Vulnerabiliteti lejonte, p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb k\u00ebrkese t\u00eb formatuar n\u00eb m\u00ebnyr\u00eb speciale, t\u00eb inicionte dereferencimin e nj\u00eb treguesi null dhe t\u00eb shp\u00ebrthente procesin. Ky vulnerabilitet gjithashtu shfaqet vet\u00ebm n\u00eb versionin 2.4.49. Si nj\u00eb mjet p\u00ebr zgjidhjen e mbrojtjes, mund t\u00eb \u00e7aktivizohet mb\u00ebshtetje p\u00ebr protokollin HTTP\\\/2.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.50, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-41773), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u0435\u0432\u043e\u0433\u043e \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0441\u0430\u0439\u0442\u0430. \u041f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b web-\u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e, \u043f\u043e\u0434 \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0437\u0430\u043f\u0443\u0449\u0435\u043d http-\u0441\u0435\u0440\u0432\u0435\u0440. \u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0431\u044b\u043b\u0438 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0435 \u0435\u0449\u0451 17 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101551","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia n\u00eb serverin http Apache 2.4.49, e cila lejon aksesin n\u00eb dosje jasht\u00eb rr\u00ebnj\u00ebs s\u00eb faqes | ProHoster","description":"N\u00eb m\u00ebnyr\u00eb urgjente \u00ebsht\u00eb formuluar nj\u00eb p\u00ebrdit\u00ebsim p\u00ebr serverin http Apache 2.4.50, i cili ka eliminuar nj\u00eb dob\u00ebsi 0-day (CVE-2021-41773), e cila lejon aksesin n\u00eb dosjet jasht\u00eb zonave t\u00eb caktuara.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0435 Apache 2.4.49, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0432\u043d\u0435 \u043a\u043e\u0440\u043d\u044f \u0441\u0430\u0439\u0442\u0430 | ProHoster","og:description":"\u0412 \u044d\u043a\u0441\u0442\u0440\u0435\u043d\u043d\u043e\u043c \u043f\u043e\u0440\u044f\u0434\u043a\u0435 \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 http-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache 2.4.50, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-41773), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c \u0438\u0437 \u043e\u0431\u043b\u0430\u0441\u0442\u0435\u0439 \u0432\u043d\u0435.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-http-servere-apache-2-4-49-pozvolyayushhaya-poluchit-fajly-vne-kornya-sajta","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-10-06T02:22:36+00:00","article:modified_time":"2021-10-06T02:22:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101551","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-10-06 02:24:19","updated":"2022-09-29 22:14:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/101551","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=101551"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/101551\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=101551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=101551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=101551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}