{"id":103981,"date":"2022-05-09T09:36:45","date_gmt":"2022-05-09T07:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-rubygems-org-pozvolyayushhaya-podmenit-chuzhie-pakety"},"modified":"2022-05-09T09:36:45","modified_gmt":"2022-05-09T07:36:45","slug":"uyazvimost-v-rubygems-org-pozvolyayushhaya-podmenit-chuzhie-pakety","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimost-v-rubygems-org-pozvolyayushhaya-podmenit-chuzhie-pakety","title":{"rendered":"Vulnerabilitet n\u00eb RubyGems.org q\u00eb lejon z\u00ebvend\u00ebsimin e paketave t\u00eb tjetrit","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb depozit\u00ebn e paketave RubyGems.org \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi kritike (CVE-2022-29176) q\u00eb lejon, pa pasur autoritetet e nevojshme, z\u00ebvend\u00ebsimin e disa paketave t\u00eb huaja n\u00eb depozit\u00eb p\u00ebrmes iniciativ\u00ebs p\u00ebr t\u00eb t\u00ebrhequr (yank) nj\u00eb paket\u00eb legjitime dhe ngarkimin e nj\u00eb skedari tjet\u00ebr me t\u00eb nj\u00ebjtin em\u00ebr dhe num\u00ebr versioni. <\/p>\n
P\u00ebr t\u00eb shfryt\u00ebzuar me sukses k\u00ebt\u00eb dob\u00ebsi, duhen plot\u00ebsuar tre kushte: <\/p>\n
\n
Sulmi mund t\u00eb kryhet vet\u00ebm ndaj paketave, ku emri p\u00ebrdor simbolin e lidhjes.\n
Shtimi duhet t\u00eb jet\u00eb n\u00eb gjendje t\u00eb vendos\u00eb nj\u00eb paket\u00eb gem me nj\u00eb pjes\u00eb emri para simbolit t\u00eb ndarjes. P\u00ebr shembull, n\u00ebse sulmi b\u00ebhet n\u00eb paket\u00ebn \u00abrails-html-sanitizer\u00bb, sulmuesi duhet t\u00eb vendos\u00eb n\u00eb depo paket\u00ebn e tij t\u00eb quajtur \u00abrails-html\u00bb.\n
Paketa q\u00eb sulmohet duhet t\u00eb ket\u00eb qen\u00eb krijuar n\u00eb 30 dit\u00ebt e fundit ose t\u00eb mos jet\u00eb p\u00ebrdit\u00ebsuar n\u00eb 100 dit\u00ebt e fundit. <\/ul>\n
Vulnera \u00ebsht\u00eb shkaktuar nga nj\u00eb gabim n\u00eb trajtuesin e veprimit \u00abyank\u00bb, i cili interpreton pjes\u00ebn e emrit pas simbolit si emrin e platform\u00ebs, gj\u00eb q\u00eb lejonte inicimin e heqjes s\u00eb paketave t\u00eb tjera q\u00eb p\u00ebrputhen n\u00eb pjes\u00ebn e emrit deri te simboli i ndarjes. Konkretisht, n\u00eb kodin e trajtuesit t\u00eb operacionit \u00abyank\u00bb p\u00ebr k\u00ebrkimin e paketave, p\u00ebrdorej thirrja \u2018find_by!(full_name: \u00ab#{rubygem.name}-#{slug}\u00bb)\u2019, kurse parametri \u00abslug\u00bb p\u00ebrcaktohej nga pronari i paket\u00ebs p\u00ebr t\u00eb caktuar versionin e fshir\u00eb. Pronari i paket\u00ebs \u00abrails-html\u00bb mund t\u00eb tregonte n\u00eb vend t\u00eb versionit \u00ab1.2.3\u00bb \u00absanitizer-1.2.3\u00bb, q\u00eb do t\u00eb \u00e7onte n\u00eb aplikimin e operacionit n\u00eb paket\u00ebn e huaj \u00abrails-html-sanitizer-1.2.3\u00bb. <\/p>\n
Problemi u identifikua nga nj\u00eb hulumtues n\u00eb fush\u00ebn e siguris\u00eb n\u00eb kuad\u00ebr t\u00eb nj\u00eb programi t\u00eb shp\u00ebrblimit n\u00eb HackerOne p\u00ebr gjetjen e problemeve t\u00eb siguris\u00eb n\u00eb projekte t\u00eb njohura me kod t\u00eb hapur. Problemi u zgjidh n\u00eb RubyGems.org m\u00eb 5 Maj dhe sipas deklaratave t\u00eb zhvilluesve, ata nuk kan\u00eb konstatuar ende prova t\u00eb shfryt\u00ebzimit t\u00eb dob\u00ebsis\u00eb n\u00eb log-et e tyre p\u00ebr 18 muajt e fundit. Megjithat\u00eb, deri tani \u00ebsht\u00eb kryer vet\u00ebm nj\u00eb auditim sip\u00ebrfaq\u00ebsor dhe planifikohet t\u00eb b\u00ebhet nj\u00eb kontroll m\u00eb i thell\u00eb n\u00eb t\u00eb ardhmen. <\/p>\n
P\u00ebr t\u00eb verifikuar projektet e tyre, rekomandohet q\u00eb t\u00eb analizohet historia e operacioneve n\u00eb skedarin Gemfile.lock, aktivizmi keqdash\u00ebs shpreh\u00ebt n\u00eb prani t\u00eb ndryshimeve q\u00eb ruajn\u00eb emrin dhe versionin ose ndryshimin e platform\u00ebs (p\u00ebr shembull, kur paketa gemname-1.2.3 \u00ebsht\u00eb p\u00ebrdit\u00ebsuar n\u00eb gemname-1.2.3-java). Si nj\u00eb metod\u00eb p\u00ebr t\u00eb mbrojtur nga z\u00ebvend\u00ebsimi i fshehur i paketave n\u00eb sistemet e integrimit t\u00eb vazhduesh\u00ebm ose gjat\u00eb publikimit t\u00eb projekteve, rekomandohet q\u00eb zhvilluesit t\u00eb p\u00ebrdorin Bundler me opsionet \u00ab--frozen\u00bb ose \u00ab--deployment\u00bb p\u00ebr t\u00eb fik\u00ebsuar var\u00ebsit\u00eb. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"