{"id":103660,"date":"2022-03-31T09:36:38","date_gmt":"2022-03-31T07:36:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah"},"modified":"2022-03-31T09:36:38","modified_gmt":"2022-03-31T07:36:38","slug":"kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","title":{"rendered":"Nj\u00eb vulnerabilitet kritik 0-day n\u00eb Spring Framework, i p\u00ebrdorur n\u00eb shum\u00eb projekte Java","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb modulin Spring Core, i ofruar si pjes\u00eb e Spring Framework, \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet kritik 0-day, q\u00eb lejon nj\u00eb sulmues t\u00eb paautentikuar t\u00eb ekzekutoj\u00eb kodin e tij n\u00eb server. Ende nuk \u00ebsht\u00eb e qart\u00eb sa katastrofike mund t\u00eb jen\u00eb pasojat e problemit t\u00eb zbuluar dhe n\u00ebse sulmet do t\u00eb jen\u00eb po aq masive sa ato q\u00eb ndodh\u00ebn me vulnerabilitetin n\u00eb Log4j 2. Vulnerabilitetit i \u00ebsht\u00eb caktuar emri kodor Spring4Shell, por identifikuesi CVE ende nuk \u00ebsht\u00eb em\u00ebruar. N\u00eb Spring Framework, problemi mbetet i pazgjidhur dhe tashm\u00eb disa prototipa funksional\u00eb eksploit\u00ebsh jan\u00eb n\u00eb dispozicion n\u00eb internet (1, 2, 3, 4). P\u00ebrkeq\u00ebsohet nga fakti se shum\u00eb aplikacione Java p\u00ebr korporata, t\u00eb bazuara n\u00eb Spring Framework, ekzekutohen me t\u00eb drejtat root dhe vulnerabiliteti lejon q\u00eb sistemi t\u00eb kompromentohet plot\u00ebsisht. <\/p>\n

Sipas disa vler\u00ebsimeve, moduli Spring Core p\u00ebrdoret n\u00eb 74% t\u00eb aplikacioneve Java. Rreziku i k\u00ebsaj dob\u00ebsie zvog\u00eblohet nga fakti se sulmi u n\u00ebnshtrohet vet\u00ebm aplikacioneve q\u00eb p\u00ebrdorin anulimin \"@RequestMapping\" kur lidhen trajtuesit e k\u00ebrkesave dhe lidhjet e parametrave t\u00eb formave web n\u00eb formatin \"name=value\" (POJO, Plain Old Java Object), n\u00eb vend t\u00eb p\u00ebrdorimit t\u00eb JSON\/XML. <\/p>\n

Nuk \u00ebsht\u00eb ende e qart\u00eb cilat aplikacione dhe framework-e Java jan\u00eb t\u00eb prekura nga problemi. Dob\u00ebsia parandalon shtimin n\u00eb list\u00ebn e zez\u00eb t\u00eb fushave \"class\", \"module\" dhe \"classLoader\" ose p\u00ebrdorimin e nj\u00eb liste t\u00eb bardh\u00eb t\u00eb fushave t\u00eb lejuara. Eksploatimi i dob\u00ebsis\u00eb \u00ebsht\u00eb i mundur vet\u00ebm me p\u00ebrdorimin e Java\/JDK 9 ose nj\u00eb version m\u00eb t\u00eb ri. Problemi shkaktohet nga mund\u00ebsia p\u00ebr t\u00eb anashkaluar mbrojtjen nga dob\u00ebsia CVE-2010-1622, e cila u korrigjua n\u00eb Spring Framework n\u00eb vitin 2010 dhe lidhet me ekzekutimin e trajtuesit classLoader gjat\u00eb analiz\u00ebs s\u00eb parametrave t\u00eb k\u00ebrkes\u00ebs. <\/p>\n

Funksionimi i eksploitatit p\u00ebrfshin d\u00ebrgimin e nj\u00eb k\u00ebrkese me parametrat \"class.module.classLoader.resources.context.parent.pipeline.first.*\", p\u00ebrpunimi i t\u00eb cilave \u00e7on n\u00eb krijimin e nj\u00eb skedari jsp n\u00eb mjedisin rr\u00ebnjor t\u00eb Apache Tomcat dhe regjistrimin n\u00eb k\u00ebt\u00eb skedar t\u00eb kodit t\u00eb caktuar nga sulmuesi. Skedari i krijuar b\u00ebhet i disponuesh\u00ebm p\u00ebr k\u00ebrkesa t\u00eb drejtp\u00ebrdrejta dhe mund t\u00eb p\u00ebrdoret si web shell. P\u00ebr t\u00eb sulmuar nj\u00eb aplikacion t\u00eb preksh\u00ebm n\u00eb mjedisin Apache Tomcat, mjafton t\u00eb d\u00ebrgoni nj\u00eb k\u00ebrkes\u00eb me parametra t\u00eb caktuar duke p\u00ebrdorur mjetin curl. curl -v -d \"class.module.classLoader.resources.context.parent.pipeline.first.pattern=kod_ p\u00ebr_t\u00eb_injektuar_n\u00eb_skedar &class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp &class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps\/ROOT &class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar &class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat= \" http:\/\/localhost:8080\/springmvc5-helloworld-exmaple-0.0.1-SNAPSHOT\/rapid7 <\/p>\n

Problemi i diskutuar n\u00eb Spring Core nuk duhet ngat\u00ebrruar me vulnerabilitetet e identifikuara s\u00eb fundmi, CVE-2022-22963 dhe CVE-2022-22950. Problemi i par\u00eb preku paket\u00ebn Spring Cloud dhe u zgjidh n\u00eb l\u00ebshimet 3.1.7 dhe 3.2.3. Problemi i dyt\u00eb \u00ebsht\u00ebpresent n\u00eb Spring Expression dhe \u00ebsht\u00eb rregulluar n\u00eb Spring Framework 5.3.17. K\u00ebto jan\u00eb vulnerabilitete thelb\u00ebsisht t\u00eb ndryshme. P\u00ebr vulnerabilitetin e ri, zhvilluesit e Spring Framework ende nuk kan\u00eb b\u00ebr\u00eb ndonj\u00eb deklarat\u00eb dhe nuk kan\u00eb publikuar nj\u00eb rregullim. <\/p>\n

Si nj\u00eb mas\u00eb t\u00eb p\u00ebrkohshme mbrojtjeje, rekomandohet p\u00ebrdorimi n\u00eb kod t\u00eb nj\u00eb liste t\u00eb zez\u00eb t\u00eb parametrave t\u00eb papranuesh\u00ebm t\u00eb k\u00ebrkes\u00ebs: import org.springframework.core.Ordered; import org.springframework.core.annotation.Order; import org.springframework.web.bind.WebDataBinder; import org.springframework.web.bind.annotation.ControllerAdvice; import org.springframework.web.bind.annotation.InitBinder; @ControllerAdvice @Order(10000) public class BinderControllerAdvice { @InitBinder public void setAllowedFields(WebDataBinder dataBinder) { String[] denylist = new String[]{\"class.\", \"Class.\", \".class.\", \".Class.\"}; dataBinder.setDisallowedFields(denylist); } }
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043c\u043e\u0434\u0443\u043b\u0435 Spring Core, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 Spring Framework, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435. \u041f\u043e\u043a\u0430 \u043d\u0435 \u044f\u0441\u043d\u043e \u043d\u0430\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0430\u0442\u0430\u0441\u0442\u0440\u043e\u0444\u0438\u0447\u043d\u044b \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438 \u0431\u0443\u0434\u0443\u0442 \u0430\u0442\u0430\u043a\u0438 \u0441\u0442\u043e\u043b\u044c \u0436\u0435 \u043c\u0430\u0441\u0441\u043e\u0432\u044b\u043c\u0438, \u043a\u0430\u043a \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e \u0432 Log4j 2. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d\u043e \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f Spring4Shell, \u043d\u043e CVE-\u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 \u043f\u043e\u043a\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103660","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabiliteti kritik 0-day n\u00eb Spring Framework, i p\u00ebrdorur n\u00eb shum\u00eb projekte Java | ProHoster","description":"N\u00eb modulin Spring Core, i dh\u00ebn\u00eb si pjes\u00eb e framework-ut Spring Framework, \u00ebsht\u00eb identifikuar nj\u00eb vulnerabilitet kritik 0-day, i cili lejon nj\u00eb sulmues t\u00eb paautorizuar q\u00eb t\u00eb ekzekutoj\u00eb kodin e tij n\u00eb server.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Spring Framework, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432\u043e \u043c\u043d\u043e\u0433\u0438\u0445 Java-\u043f\u0440\u043e\u0435\u043a\u0442\u0430\u0445 | ProHoster","og:description":"\u0412 \u043c\u043e\u0434\u0443\u043b\u0435 Spring Core, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0430 Spring Framework, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f 0-day \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/kriticheskaya-0-day-uyazvimost-v-spring-framework-primenyaemom-vo-mnogih-java-proektah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-03-31T07:36:38+00:00","article:modified_time":"2022-03-31T07:36:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103660","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-03-31 07:37:59","updated":"2022-09-27 15:24:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/103660","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=103660"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/103660\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=103660"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=103660"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=103660"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}