{"id":108322,"date":"2023-05-04T12:48:14","date_gmt":"2023-05-04T10:48:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=108322"},"modified":"2023-05-04T18:45:37","modified_gmt":"2023-05-04T16:45:37","slug":"perehvachen-kontrol-nad-14-php-bibliotkami-v-repozitorii-packagist","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/perehvachen-kontrol-nad-14-php-bibliotkami-v-repozitorii-packagist","title":{"rendered":"Kontrolli mbi 14 bibliotekat PHP n\u00eb depozitarin Packagist \u00ebsht\u00eb kapur","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Administratoret e depozit\u00ebs s\u00eb paketave Packagist zbuluan informacione mbi nj\u00eb sulm, n\u00eb t\u00eb cilin u pushtuan llogarit\u00eb e mbik\u00ebqyr\u00ebsve t\u00eb 14 biblioteka PHP, p\u00ebrfshir\u00eb paketa t\u00eb njohura si instantiator (526 milion instalime gjithsej, 8 milion instalime p\u00ebr muaj, 323 pako t\u00eb varura), sql-formatter (94 milion instalime gjithsej, 800 mij\u00eb n\u00eb muaj, 109 pako t\u00eb varura), doctrine-cache-bundle (73 milion instalime gjithsej, 500 mij\u00eb n\u00eb muaj, 348 pako t\u00eb varura) dhe rcode-detector-decoder (20 milion instalime gjithsej, 400 mij\u00eb n\u00eb muaj, 66 pako t\u00eb varura). <\/p>\n

Pas pasur compromitimin e llogarive, sulmuesi modifikoi skedarin composer.json, duke shtuar n\u00eb fush\u00ebn e p\u00ebrshkrimit t\u00eb projektit informacionin se po k\u00ebrkon pun\u00eb q\u00eb lidhet me sigurin\u00eb informative. P\u00ebr t\u00eb b\u00ebr\u00eb ndryshimin n\u00eb skedarin composer.json, sulmuesi z\u00ebvend\u00ebsoi URL-t\u00eb e repozitor\u00ebve origjinal\u00eb me lidhjet n\u00eb forkat e modifikuara (n\u00eb Packagist ofrohen vet\u00ebm metadata me lidhje n\u00eb projektet q\u00eb zhvillohen n\u00eb GitHub, gjat\u00eb instalimit me komandat \u00abcomposer install\u00bb ose \u00abcomposer update\u00bb, paketat shkarkohen direkt nga GitHub). P\u00ebr shembull, p\u00ebr paket\u00ebn acmephp, repozitori i lidhur u z\u00ebvend\u00ebsua nga acmephp\/acmephp n\u00eb neskafe3v1\/acmephp. <\/p>\n

Duke gjykuar, sulmi nuk ishte kryer p\u00ebr t\u00eb realizuar veprime t\u00eb d\u00ebmshme, por si nj\u00eb demonstrim i papranueshm\u00ebris\u00eb s\u00eb trajtimit t\u00eb pakujdessh\u00ebm t\u00eb p\u00ebrdorimit t\u00eb t\u00eb dh\u00ebnave t\u00eb p\u00ebrs\u00ebritura n\u00eb sitet e ndryshme. N\u00eb k\u00ebt\u00eb rast, sulmuesi p\u00ebrkundrazi n\u00eb lidhje me praktik\u00ebn e krijuar t\u00eb \u00abhakimeve etike\u00bb nuk e njoftoi paraprakisht zhvilluesit e bibliotekave dhe administrator\u00ebt e repozitorit p\u00ebr eksperimentin q\u00eb po kryente. M\u00eb von\u00eb, sulmuesi njoftoi se, pasi t'i b\u00ebhej e mundur t\u00eb merrte nj\u00eb pun\u00eb, do t\u00eb publikonte nj\u00eb raport t\u00eb detajuar mbi metodat e p\u00ebrdorura n\u00eb sulm. <\/p>\n

Sipas t\u00eb dh\u00ebnave t\u00eb publikuara nga administrator\u00ebt e Packagist, t\u00eb gjitha llogarit\u00eb q\u00eb menaxhonin paketat e komprometuara kishin fjal\u00ebkalime t\u00eb lehta p\u00ebr t'u gjendur dhe nuk kishin aktivizuar autentifikimin me dy faktor\u00eb. Raportohet se n\u00eb llogarit\u00eb e hakuara ishin p\u00ebrdorur fjal\u00ebkalime q\u00eb ishin aplikuar jo vet\u00ebm n\u00eb Packagist, por edhe n\u00eb sh\u00ebrbime t\u00eb tjera, t\u00eb cilat kishin pasur baza fjal\u00ebkalimesh t\u00eb komprometuar dhe ishin b\u00ebr\u00eb publike. Nj\u00eb opsion tjet\u00ebr p\u00ebr t\u00eb fituar aksesin mund t\u00eb ket\u00eb qen\u00eb kapja e email-eve t\u00eb pronar\u00ebve t\u00eb llogarive, t\u00eb cilat ishin t\u00eb lidhura me domein\u00eb t\u00eb skaduar. <\/p>\n

Paketet e komprometuar: <\/p>\n