{"id":108322,"date":"2023-05-04T12:48:14","date_gmt":"2023-05-04T10:48:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=108322"},"modified":"2023-05-04T18:45:37","modified_gmt":"2023-05-04T16:45:37","slug":"perehvachen-kontrol-nad-14-php-bibliotkami-v-repozitorii-packagist","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/perehvachen-kontrol-nad-14-php-bibliotkami-v-repozitorii-packagist","title":{"rendered":"Kontrolli mbi 14 bibliotekat PHP n\u00eb depon Packagist \u00ebsht\u00eb kapur","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Administrator\u00ebt e depove t\u00eb paketave Packagist zbuluan informacione mbi nj\u00eb sulm, si rezultat i s\u00eb cilit u kap kontrolli mbi llogarit\u00eb e ndihm\u00ebsve t\u00eb 14 bibliotekave PHP, p\u00ebrfshir\u00eb paketa kaq popullore si instantiator (526 milion instalime n\u00eb total, 8 milion instalime n\u00eb muaj, 323 pako t\u00eb varura), sql-formatter (94 milion instalime n\u00eb total, 800 mij\u00eb n\u00eb muaj, 109 pako t\u00eb varura), doctrine-cache-bundle (73 milion instalime n\u00eb total, 500 mij\u00eb n\u00eb muaj, 348 pako t\u00eb varura) dhe rcode-detector-decoder (20 milion instalime n\u00eb total, 400 mij\u00eb n\u00eb muaj, 66 pako t\u00eb varura). <\/p>\n

Pas pas nj\u00eb komprometim t\u00eb llogarive, sulmuesi ndryshoi skedarin composer.json, duke shtuar n\u00eb fush\u00ebn e p\u00ebrshkrimit t\u00eb projektit informacionin se po k\u00ebrkonte pun\u00eb n\u00eb fush\u00ebn e siguris\u00eb informatike. P\u00ebr t\u00eb b\u00ebr\u00eb ndryshimin n\u00eb skedarin composer.json, sulmuesi z\u00ebvend\u00ebsoi URL-t\u00eb e depozitave origjinale me linke n\u00eb forka t\u00eb modifikuara (n\u00eb Packagist ofrohen vet\u00ebm metadata me lidhje n\u00eb projekte q\u00eb zhvillohen n\u00eb GitHub, kur ekzekutohet komanda \u201ecomposer install\u201c ose \u201ecomposer update\u201c, paketat shkarkohen direkt nga GitHub). P\u00ebr shembull, p\u00ebr paket\u00ebn acmephp, depozita e lidhur u z\u00ebvend\u00ebsua nga acmephp\/acmephp n\u00eb neskafe3v1\/acmephp. <\/p>\n

Duket se sulmi nuk u krye p\u00ebr t\u00eb realizuar veprime t\u00eb d\u00ebmshme, por si nj\u00eb demonstruese e papranueshm\u00ebris\u00eb s\u00eb p\u00ebrdorimit t\u00eb pakujdessh\u00ebm t\u00eb kredencialeve t\u00eb p\u00ebrs\u00ebritura n\u00eb faqe t\u00eb ndryshme. Mega sulmuesi, p\u00ebrkund\u00ebr praktikave t\u00eb vendosura t\u00eb \u201ehakimit etik\u201c, nuk i informoi paraprakisht zhvilluesit e bibliotekave dhe administrator\u00ebt e depozitit p\u00ebr eksperimentin q\u00eb po realizonte. M\u00eb von\u00eb, sulmuesi njoftoi se pasi t\u00eb arrinte t\u00eb merrte pun\u00eb, do t\u00eb publikonte nj\u00eb raport t\u00eb detajuar mbi metodat e p\u00ebrdorura n\u00eb sulm. <\/p>\n

Sipas t\u00eb dh\u00ebnave t\u00eb publikuara nga administrator\u00ebt e Packagist, n\u00eb t\u00eb gjitha llogarit\u00eb q\u00eb menaxhonin paketat e komprometuara, ishin p\u00ebrdorur fjal\u00ebkalime t\u00eb thjeshta p\u00ebr t'u zbuluar pa aktivizuar verifikimin me dy faktor\u00eb. Po ashtu, pretendohet se n\u00eb llogarit\u00eb e hackuara ishin p\u00ebrdorur fjal\u00ebkalime q\u00eb ishin aplikuar jo vet\u00ebm n\u00eb Packagist, por edhe n\u00eb sh\u00ebrbime t\u00eb tjera, bazat e fjal\u00ebkalimeve t\u00eb t\u00eb cil\u00ebve ishin komprometuar m\u00eb her\u00ebt dhe ishin b\u00ebr\u00eb publike. Si nj\u00eb mund\u00ebsi p\u00ebr t\u00eb siguruar qasje, gjithashtu mund t\u00eb ishte p\u00ebrdorur kapja e emailit t\u00eb pronar\u00ebve t\u00eb llogarive, t\u00eb cilat ishin t\u00eb lidhura me domene t\u00eb skaduara. <\/p>\n

Paketa t\u00eb komprometuara: <\/p>\n