{"id":102300,"date":"2021-11-16T21:36:39","date_gmt":"2021-11-16T19:36:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm"},"modified":"2021-11-16T21:36:39","modified_gmt":"2021-11-16T19:36:39","slug":"uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","title":{"rendered":"Vulnerabiliteti q\u00eb lejonte l\u00ebshimin e nj\u00eb azhurnimi p\u00ebr \u00e7do paket\u00eb n\u00eb depotin NPM","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania GitHub shpalli informacion p\u00ebr dy incidente n\u00eb infrastruktur\u00ebn e repositorit t\u00eb paketave NPM. M\u00eb 2 n\u00ebntor, hulumtuesit e jasht\u00ebm t\u00eb siguris\u00eb (Kajetan Grzybowski dhe Maciej Piechota) n\u00eb kuad\u00ebr t\u00eb programit Bug Bounty njoftuan p\u00ebr nj\u00eb dob\u00ebsi n\u00eb repositorin NPM q\u00eb lejonte publikimin e nj\u00eb versioni t\u00eb ri t\u00eb \u00e7do pakete duke p\u00ebrdorur llogarin\u00eb e tij, e cila nuk ishte e autorizuar p\u00ebr t\u00eb kryer p\u00ebrdit\u00ebsime t\u00eb tilla. <\/p>\n

Dob\u00ebsia ishte shkaktuar nga nj\u00eb verifikim i pap\u00ebrshtatsh\u00ebm i autorizimeve n\u00eb kodin e mikrosh\u00ebrbimeve q\u00eb p\u00ebrpunonin k\u00ebrkesat p\u00ebr NPM. Sh\u00ebrbimi i autorizimit b\u00ebnte verifikimin e t\u00eb drejtave t\u00eb aksesit n\u00eb paketat n\u00eb baz\u00eb t\u00eb t\u00eb dh\u00ebnave t\u00eb d\u00ebrguara n\u00eb k\u00ebrkes\u00eb, por nj\u00eb sh\u00ebrbim tjet\u00ebr, q\u00eb ngarkonte p\u00ebrdit\u00ebsimin n\u00eb repositor, p\u00ebrcaktonte paket\u00ebn p\u00ebr publikim n\u00eb baz\u00eb t\u00eb p\u00ebrmbajtjes s\u00eb metadatatave n\u00eb paket\u00ebn e ngarkuar. K\u00ebshtu, nj\u00eb sulmues mund t\u00eb k\u00ebrkonte publikimin e nj\u00eb p\u00ebrdit\u00ebsimi p\u00ebr paket\u00ebn e tij, p\u00ebr t\u00eb cil\u00ebn kishte qasje, por t\u00eb specifikonte n\u00eb paket\u00eb informacion p\u00ebr nj\u00eb paket\u00eb tjet\u00ebr, e cila do t\u00eb p\u00ebrdit\u00ebsohej n\u00eb fund. <\/p>\n

Problemi u zgjidh brenda 6 or\u00ebsh pas shfaqjes s\u00eb informacionit p\u00ebr dob\u00ebsin\u00eb, por dob\u00ebsia kishte qen\u00eb e pranishme n\u00eb NPM m\u00eb gjat\u00eb se sa logjet e telemetris\u00eb mbulonin. GitHub pretendon se nuk jan\u00eb regjistruar prova t\u00eb sulmeve q\u00eb p\u00ebrdorin k\u00ebt\u00eb dob\u00ebsi q\u00eb nga september 2020, por nuk ka garanci se problemi nuk \u00ebsht\u00eb shfryt\u00ebzuar m\u00eb her\u00ebt. <\/p>\n

Incidenti i dyt\u00eb ndodhi m\u00eb 26 tetor. Gjat\u00eb punimeve teknike me baz\u00ebn e t\u00eb dh\u00ebnave t\u00eb sh\u00ebrbimit replicate.npmjs.com, u zbulua se n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave t\u00eb aksesueshme p\u00ebr k\u00ebrkesat e jashtme kishte t\u00eb dh\u00ebna konfidenciale q\u00eb zbulonin informacion rreth emrave t\u00eb paketimeve t\u00eb brendshme q\u00eb u p\u00ebrmend\u00ebn n\u00eb logun e ndryshimeve. Informacioni mbi k\u00ebta emra mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb kryer sulme ndaj var\u00ebsive n\u00eb projektet e brendshme (n\u00eb shkurt, nj\u00eb sulm i till\u00eb i dha mund\u00ebsin\u00eb p\u00ebr t\u00eb ekzekutuar kod n\u00eb server\u00eb<\/a> PayPal, Microsoft, Apple, Netflix, Uber dhe 30 kompani t\u00eb tjera). <\/p>\n

P\u00ebr m\u00eb tep\u00ebr, p\u00ebr shkak t\u00eb rasteve n\u00eb rritje t\u00eb kapjes s\u00eb repositorive t\u00eb projekteve t\u00eb m\u00ebdha dhe promovimit t\u00eb kodit t\u00eb d\u00ebmsh\u00ebm p\u00ebrmes ndyr\u00ebsis\u00eb s\u00eb llogarive t\u00eb zhvilluesve, kompania GitHub mori vendimin p\u00ebr t\u00eb futur autentifikimin me dy faktor\u00eb si t\u00eb detyruesh\u00ebm. Ky ndryshim do t\u00eb hyj\u00eb n\u00eb fuqi n\u00eb tremujorin e par\u00eb t\u00eb vitit 2022 dhe do t\u00eb p\u00ebrfshij\u00eb mbik\u00ebqyr\u00ebsit dhe administrator\u00ebt e paketeve t\u00eb p\u00ebrfshira n\u00eb list\u00ebn e atyre m\u00eb t\u00eb njohur. Shtes\u00eb p\u00ebr k\u00ebt\u00eb, \u00ebsht\u00eb e raportuar p\u00ebr modernizimin e infrastruktur\u00ebs, ku do t\u00eb implementohet monitoring automatizuar dhe analiza e versioneve t\u00eb reja t\u00eb paketeve p\u00ebr t\u00eb zbuluar p\u00ebr ndryshime t\u00eb d\u00ebmshme n\u00eb fazat e hershme. <\/p>\n

Kujtojm\u00eb se, sipas nj\u00eb studimi t\u00eb realizuar n\u00eb vitin 2020, vet\u00ebm 9.27% e administrator\u00ebve t\u00eb paketeve p\u00ebrdorin autentifikimin me dy faktor\u00eb p\u00ebr t\u00eb mbrojtur qasjen, nd\u00ebrsa n\u00eb 13.37% t\u00eb rasteve, gjat\u00eb regjistrimit t\u00eb llogarive t\u00eb reja, zhvilluesit p\u00ebrpiqeshin t\u00eb ri-p\u00ebrdornin fjal\u00ebkalime t\u00eb komprometuar, q\u00eb shfaqeshin n\u00eb k\u00ebt\u00eb lloj rrjedhjesh fjal\u00ebkalimesh. Gjat\u00eb kontrollit t\u00eb q\u00ebndrueshm\u00ebris\u00eb s\u00eb fjal\u00ebkalimeve t\u00eb p\u00ebrdorura, arrit\u00ebm t\u00eb qasemi n\u00eb 12% t\u00eb llogarive n\u00eb NPM (13% t\u00eb paketeve) p\u00ebr shkak t\u00eb p\u00ebrdorimit t\u00eb fjal\u00ebkalimeve t\u00eb parashikueshme dhe triviale, si «123456». N\u00eb mesin e problemeve ishin 4 llogari t\u00eb p\u00ebrdoruesve nga Top 20 paketet m\u00eb t\u00eb njohura, 13 llogari t\u00eb paketave q\u00eb jan\u00eb shkarkuar m\u00eb shum\u00eb se 50 milion her\u00eb n\u00eb muaj, 40 \u2014 m\u00eb shum\u00eb se 10 milion shkarkime n\u00eb muaj dhe 282 me m\u00eb shum\u00eb se 1 milion shkarkime n\u00eb muaj. Duke marr\u00eb parasysh shkarkimet e moduleve p\u00ebrmes zinxhir\u00ebve t\u00eb var\u00ebsive, komprometimi i llogarive t\u00eb pasigurta mund t\u00eb kishte prekur deri n\u00eb 52% t\u00eb t\u00eb gjitha moduleve n\u00eb NPM.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0432\u0443\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM. 2 \u043d\u043e\u044f\u0431\u0440\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (Kajetan Grzybowski \u0438 Maciej Piechota) \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Bug Bounty \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0441\u0432\u043e\u044e \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u043d\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102300","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia q\u00eb lejonte publikimin e nj\u00eb p\u00ebrdit\u00ebsimi p\u00ebr \u00e7do paket\u00eb n\u00eb repositorin NPM | ProHoster","description":"Kompania GitHub shpalli informacion p\u00ebr dy incidente n\u00eb infrastruktur\u00ebn e repositorit t\u00eb paketave NPM. M\u00eb 2 n\u00ebntor, hulumtuesit e jasht\u00ebm t\u00eb siguris\u00eb (Kajetan Grzybowski dhe Maciej Piechota) n\u00eb kuad\u00ebr t\u00eb programit Bug Bounty njoftuan p\u00ebr nj\u00eb dob\u00ebsi n\u00eb repositorin NPM q\u00eb lejonte publikimin e nj\u00eb versioni t\u00eb ri t\u00eb \u00e7do pakete duke p\u00ebrdorur llogarin\u00eb e tij, e cila nuk ishte e autorizuar p\u00ebr t\u00eb kryer p\u00ebrdit\u00ebsime t\u00eb tilla. Dob\u00ebsia u shkaktua","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitHub \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0430 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0434\u0432\u0443\u0445 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u0445 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f \u043f\u0430\u043a\u0435\u0442\u043e\u0432 NPM. 2 \u043d\u043e\u044f\u0431\u0440\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (Kajetan Grzybowski \u0438 Maciej Piechota) \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b Bug Bounty \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0438 \u043e \u043d\u0430\u043b\u0438\u0447\u0438\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 NPM \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u0442\u044c \u043d\u043e\u0432\u0443\u044e \u0432\u0435\u0440\u0441\u0438\u044e \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u0441\u0432\u043e\u044e \u0443\u0447\u0451\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c, \u043d\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0443\u044e \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0445 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u044b\u043b\u0430 \u0432\u044b\u0437\u0432\u0430\u043d\u0430","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-pozvolyavshaya-vypustit-obnovlenie-dlya-lyubogo-paketa-v-repozitorii-npm","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-16T19:36:39+00:00","article:modified_time":"2021-11-16T19:36:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102300","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-16 19:37:47","updated":"2022-10-03 22:09:30","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=102300"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102300\/revisions"}],"predecessor-version":[{"id":164408,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/102300\/revisions\/164408"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=102300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=102300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=102300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}