{"id":106652,"date":"2023-02-06T18:48:11","date_gmt":"2023-02-06T16:48:12","guid":{"rendered":"https:\/\/prohoster.info\/?p=106652"},"modified":"2023-02-07T12:08:50","modified_gmt":"2023-02-07T10:08:50","slug":"uyazvimost-v-imagemagick-privodyashhaya-k-utechke-soderzhimogo-lokalnyh-fajlov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-imagemagick-privodyashhaya-k-utechke-soderzhimogo-lokalnyh-fajlov","title":{"rendered":"Nj\u00eb vulnerabilitet n\u00eb ImageMagick q\u00eb \u00e7on n\u00eb rrjedhjen e p\u00ebrmbajtjes s\u00eb skedareve lokale","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb paket\u00ebn ImageMagick, e cila p\u00ebrdoret shpesh nga zhvilluesit web p\u00ebr t\u00eb transformuar imazhe, \u00ebsht\u00eb identifikuar nj\u00eb dob\u00ebsi CVE-2022-44268, e cila mund t\u00eb \u00e7oj\u00eb n\u00eb rrjedhjen e p\u00ebrmbajtjes s\u00eb skedar\u00ebve n\u00eb rastin e transformimit t\u00eb imazheve PNG t\u00eb p\u00ebrgatitura nga sulmuesi. Kjo dob\u00ebsi k\u00ebrc\u00ebnon sistemet q\u00eb trajtojn\u00eb imazhe t\u00eb jashtme dhe pas k\u00ebsaj lejojn\u00eb skedar\u00ebt e p\u00ebrpunuar t\u00eb ngarkohen. <\/p>\n

Dob\u00ebsia \u00ebsht\u00eb shkaktuar nga fakti se, gjat\u00eb p\u00ebrpunimit t\u00eb imazhit PNG, ImageMagick p\u00ebrdor p\u00ebrmbajtjen e parametrin «profile» nga blloku i t\u00eb dh\u00ebnave p\u00ebr t\u00eb caktuar emrin e skedarit t\u00eb profilit, i cili p\u00ebrfshihet n\u00eb skedarin e rezultatit. Pra, p\u00ebr ta sulmuar, mjafton t\u00eb shtoni n\u00eb imazhin PNG nj\u00eb parametrin «profile» me rrug\u00ebn e nevojshme t\u00eb skedarit (p.sh., « \/etc\/passwd») dhe, gjat\u00eb p\u00ebrpunimit t\u00eb nj\u00eb imazhi t\u00eb till\u00eb, p\u00ebr shembull, kur rregullohet madh\u00ebsia e imazhit, n\u00eb skedarin e daljes do t\u00eb p\u00ebrfshihet p\u00ebrmbajtja e skedarit t\u00eb nevojsh\u00ebm. N\u00ebse n\u00eb vend t\u00eb emrit t\u00eb skedarit p\u00ebrdoret «-«, at\u00ebher\u00eb procesori do t\u00eb ngel\u00eb duke pritur input nga rrjedha standarde, gj\u00eb q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb shkaktuar nj\u00eb refuzim t\u00eb sh\u00ebrbimit (CVE-2022-44267). <\/p>\n

Nj\u00eb p\u00ebrdit\u00ebsim me rregullimin e dob\u00ebsis\u00eb ende nuk \u00ebsht\u00eb l\u00ebshuar, por zhvilluesit e ImageMagick rekomanduan, si nj\u00eb zgjidhje p\u00ebr t\u00eb bllokuar rrjedhjen, t\u00eb krijojn\u00eb n\u00eb konfigurime nj\u00eb rregull q\u00eb kufizon qasjen n\u00eb rrug\u00eb t\u00eb caktuara skedar\u00ebsh. P\u00ebr shembull, p\u00ebr t\u00eb parandaluar qasjen p\u00ebrmes rrug\u00ebve absolute dhe relative n\u00eb policy.xml mund t\u00eb shtoni: <policy domain=»path» rights=»none» pattern=»\/*» \/> <policy domain=»path» rights=»none» pattern=»..\/*» \/> <\/p>\n

Nj\u00eb skript p\u00ebr krijimin e imazheve PNG q\u00eb shfryt\u00ebzojn\u00eb dob\u00ebsin\u00eb tashm\u00eb \u00ebsht\u00eb publikuar n\u00eb m\u00ebnyr\u00eb t\u00eb hapur.

\"Nj\u00eb<\/center>
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 ImageMagick, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0447\u0430\u0441\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f web-\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-44268, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 ImageMagick \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c PNG-\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0433\u0440\u043e\u0436\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0442 \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f \u0438 \u0437\u0430\u0442\u0435\u043c \u0434\u0430\u044e\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u044b \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0437\u0432\u0430\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 PNG-\u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u044f ImageMagick \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 «profile» […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":106653,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106652","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Shfryt\u00ebzimi i ImageMagick q\u00eb \u00e7on n\u00eb rrjedhjen e p\u00ebrmbajtjes s\u00eb skedareve lokale | ProHoster","description":"N\u00eb paket\u00ebn ImageMagick, e cila p\u00ebrdoret shpesh nga zhvilluesit e uebit p\u00ebr t\u00eb transformuar imazhe, \u00ebsht\u00eb identifikuar nj\u00eb vulnerabilitet CVE-2022-44268, i cili mund t\u00eb \u00e7oj\u00eb n\u00eb rrjedhjen e p\u00ebrmbajtjes s\u00eb skedar\u00ebve gjat\u00eb transformimit.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-imagemagick-privodyashhaya-k-utechke-soderzhimogo-lokalnyh-fajlov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 ImageMagick, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432 | ProHoster","og:description":"\u0412 \u043f\u0430\u043a\u0435\u0442\u0435 ImageMagick, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0447\u0430\u0441\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f web-\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u0434\u043b\u044f \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u0437\u043e\u0431\u0440\u0430\u0436\u0435\u043d\u0438\u0439, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2022-44268, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0443\u0442\u0435\u0447\u043a\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u0440\u0438.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-imagemagick-privodyashhaya-k-utechke-soderzhimogo-lokalnyh-fajlov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-02-06T16:48:12+00:00","article:modified_time":"2023-02-07T10:08:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/106652","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=106652"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/106652\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/106653"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=106652"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=106652"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=106652"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}