{"id":103981,"date":"2022-05-09T09:36:45","date_gmt":"2022-05-09T07:36:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-rubygems-org-pozvolyayushhaya-podmenit-chuzhie-pakety"},"modified":"2022-05-09T09:36:45","modified_gmt":"2022-05-09T07:36:45","slug":"uyazvimost-v-rubygems-org-pozvolyayushhaya-podmenit-chuzhie-pakety","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-rubygems-org-pozvolyayushhaya-podmenit-chuzhie-pakety","title":{"rendered":"Dob\u00ebsi n\u00eb RubyGems.org q\u00eb lejon z\u00ebvend\u00ebsimin e paketave t\u00eb huaja","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb depozit\u00ebn e paketave RubyGems.org \u00ebsht\u00eb zbuluar nj\u00eb dob\u00ebsi kritike (CVE-2022-29176), e cila b\u00ebn t\u00eb mundur, pa autorizimin e duhur, z\u00ebvend\u00ebsimin e disa paketave t\u00eb huaja n\u00eb depozit\u00eb duke nisur t\u00ebrheqjen (yank) e nj\u00eb pakete legjitime dhe duke ngarkuar n\u00eb vend t\u00eb saj nj\u00eb skedar tjet\u00ebr me t\u00eb nj\u00ebjtin em\u00ebr dhe t\u00eb nj\u00ebjtin num\u00ebr versioni. <\/p>\n
P\u00ebr shfryt\u00ebzimin me sukses t\u00eb dob\u00ebsis\u00eb duhet t\u00eb plot\u00ebsohen tre kushte: <\/p>\n
\n
Sulmi mund t\u00eb kryhet vet\u00ebm ndaj paketave, emri i t\u00eb cilave p\u00ebrmban shenj\u00ebn e viz\u00ebs lidh\u00ebse.\n
Sulmuesi duhet t\u00eb ket\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb vendosur nj\u00eb paket\u00eb gem me pjes\u00ebn e emrit deri n\u00eb simbolin e lidhjes. P\u00ebr shembull, n\u00ebse sulmi kryhet ndaj paket\u00ebs \u00abrails-html-sanitizer\u00bb, sulmuesi duhet t\u00eb vendos\u00eb n\u00eb repository paket\u00ebn e tij \u00abrails-html\u00bb.\n
Paketa ndaj s\u00eb cil\u00ebs kryhet sulmi duhet t\u00eb jet\u00eb krijuar gjat\u00eb 30 dit\u00ebve t\u00eb fundit ose t\u00eb mos jet\u00eb p\u00ebrdit\u00ebsuar p\u00ebr 100 dit\u00eb. <\/ul>\n
Vulnerabiliteti shkaktohet nga nj\u00eb gabim n\u00eb menaxherin e veprimit \u00abyank\u00bb, i cili interpreton pjes\u00ebn e emrit pas lidhjes si emrin e platform\u00ebs, duke lejuar iniciimin e fshirjes s\u00eb paketave t\u00eb huaja q\u00eb p\u00ebrputhen me pjes\u00ebn e emrit deri n\u00eb simbolin e lidhjes. N\u00eb ve\u00e7anti, n\u00eb kodin e menaxherit t\u00eb operacionit \u00abyank\u00bb p\u00ebr t\u00eb k\u00ebrkuar paketat p\u00ebrdorej thirrja \u2018find_by!(full_name: \u00ab#{rubygem.name}-#{slug}\u00bb)\u2019, nd\u00ebrkoh\u00eb q\u00eb parametrin \u00abslug\u00bb e kalonte pronari i paket\u00ebs p\u00ebr t\u00eb p\u00ebrcaktuar versionin q\u00eb duhej fshir\u00eb. Pronari i paket\u00ebs \u00abrails-html\u00bb n\u00eb vend t\u00eb versionit \u00ab1.2.3\u00bb mund t\u00eb tregonte \u00absanitizer-1.2.3\u00bb, \u00e7ka do t\u00eb \u00e7onte n\u00eb aplikimin e operacionit n\u00eb paket\u00ebn e huaj \u00abrails-html-sanitizer-1.2.3\u00bb. <\/p>\n
Problemi u zbulua nga nj\u00eb studiues i siguris\u00eb n\u00eb kuad\u00ebr t\u00eb programit aktiv t\u00eb shp\u00ebrblimeve n\u00eb HackerOne p\u00ebr gjetjen e problemeve t\u00eb siguris\u00eb n\u00eb projekte t\u00eb njohura open source. Problemi u korrigjua n\u00eb RubyGems.org m\u00eb 5 maj dhe, sipas deklarat\u00ebs s\u00eb zhvilluesve, deri tani nuk jan\u00eb gjetur gjurm\u00eb t\u00eb shfryt\u00ebzimit t\u00eb k\u00ebsaj dob\u00ebsie n\u00eb log-et e 18 muajve t\u00eb fundit. Megjithat\u00eb, deri m\u00eb tani \u00ebsht\u00eb kryer vet\u00ebm nj\u00eb auditim sip\u00ebrfaq\u00ebsor dhe n\u00eb vijim planifikohet nj\u00eb verifikim m\u00eb i thelluar. <\/p>\n
P\u00ebr t\u00eb verifikuar projektet e tyre, rekomandohet analiza e historis\u00eb s\u00eb operacioneve n\u00eb skedarin Gemfile.lock; aktiviteti keqdash\u00ebs shfaqet n\u00eb pranin\u00eb e ndryshimeve me ruajtjen e emrit dhe versionit ose ndryshimin e platform\u00ebs (p\u00ebr shembull, kur paketa gemname-1.2.3 \u00ebsht\u00eb azhurnuar n\u00eb gemname-1.2.3-java). Si nj\u00eb metod\u00eb anashkalimi p\u00ebr mbrojtjen nga z\u00ebvend\u00ebsimi i fshehur t\u00eb paketave n\u00eb sistemet e integrimit t\u00eb vazhduesh\u00ebm ose gjat\u00eb publikimit t\u00eb projekteve, \u00ebsht\u00eb rekomanduar q\u00eb zhvilluesit t\u00eb p\u00ebrdorin Bundler me opsionet \u2018--frozen\u2019 ose \u2018--deployment\u2019 p\u00ebr t\u00eb ngrir\u00eb var\u00ebsit\u00eb. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"