{"id":105422,"date":"2022-10-30T21:36:53","date_gmt":"2022-10-30T19:36:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos"},"modified":"2022-10-30T21:36:53","modified_gmt":"2022-10-30T19:36:53","slug":"uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos","title":{"rendered":"Vulnerabilitetet n\u00eb nd\u00ebrfaqen web t\u00eb pajisjeve rrjetore Juniper, q\u00eb vijn\u00eb me JunOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb nd\u00ebrfaqen web J-Web, e cila p\u00ebrdoret n\u00eb pajisjet rrjetore t\u00eb kompanis\u00eb Juniper, t\u00eb pajisura me sistemin operativ JunOS, jan\u00eb identifikuar disa vulnerabilitete, m\u00eb e rrezikshmja prej t\u00eb cilave (CVE-2022-22241) lejon q\u00eb nj\u00eb kod t\u00eb ekzekutohet n\u00eb sistem p\u00ebrmes d\u00ebrgimit t\u00eb nj\u00eb HTTP request-i t\u00eb formatuar posa\u00e7\u00ebrisht, pa kaluar procesin e autentifikimit. P\u00ebrdoruesve t\u00eb pajisjeve Juniper u rekomandohet t\u00eb instalojn\u00eb nj\u00eb p\u00ebrdit\u00ebsim t\u00eb firmware-it, dhe n\u00ebse kjo nuk \u00ebsht\u00eb e mundur, t\u00eb sigurojn\u00eb q\u00eb aksesin n\u00eb nd\u00ebrfaqen web ta ken\u00eb t\u00eb bllokuar nga rrjetet e jashtme dhe t\u00eb kufizuar vet\u00ebm p\u00ebr hoste t\u00eb besuesh\u00ebm. <\/p>\n

The essence of the vulnerability lies in the fact that the file path provided by the user is processed in the script \/jsdm\/ajax\/logging_browse.php without filtering the prefix containing the content type before the authentication check. An attacker can pass a malicious phar file disguised as an image and achieve the execution of PHP code embedded in the phar archive, utilizing the 'Phar deserialization' attack method (for example, by specifying in the request 'filepath=phar:\/path\/pharfile.jpg'). <\/p>\n

The problem is that when checking the uploaded file using the PHP function is_dir(), this function automatically performs deserialization of metadata from the Phar archive (PHP Archive) when processing paths that start with 'phar:\/\/'. The same effect is observed when processing user-submitted file paths in the functions file_get_contents(), fopen(), file(), file_exists(), md5_file(), filemtime(), and filesize(). <\/p>\n

Sulmi v\u00ebshtir\u00ebsohet nga fakti se p\u00ebrve\u00e7 inicimit t\u00eb ekzekutimit t\u00eb arkivit phar, sulmuesi duhet t\u00eb gjej\u00eb nj\u00eb m\u00ebnyr\u00eb p\u00ebr ta ngarkuar at\u00eb n\u00eb pajisje (p\u00ebrmes qasjes n\u00eb \/jsdm\/ajax\/logging_browse.php mund vet\u00ebm t\u00eb specifikohet nj\u00eb rrug\u00eb p\u00ebr t\u00eb ekzekutuar nj\u00eb skedar ekzistues). Nd\u00ebr skenar\u00ebt e mundsh\u00ebm p\u00ebr t\u00eb ngarkuar skedar\u00eb n\u00eb pajisje p\u00ebrmenden ngarkimi i nj\u00eb skedari phar n\u00ebn emrin e nj\u00eb imazhi p\u00ebrmes sh\u00ebrbimit t\u00eb transmetimit t\u00eb imazheve dhe injektimi i skedarit n\u00eb cache-n e p\u00ebrmbajtjes web. <\/p>\n

Dob\u00ebsi t\u00eb tjera: <\/p>\n