{"id":116725,"date":"2024-06-23T03:39:41","date_gmt":"2024-06-23T01:39:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz"},"modified":"2024-06-23T03:39:41","modified_gmt":"2024-06-23T01:39:41","slug":"uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb paket\u00ebn Python Js2Py, e shkarkuar m\u00eb shum\u00eb se nj\u00eb milion her\u00eb n\u00eb muaj","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb paket\u00ebn Python Js2Py, e cila \u00ebsht\u00eb shkarkuar 1.2 milion her\u00eb muajin e kaluar, \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet (CVE-2024-28397) q\u00eb lejon bypass t\u00eb izolimin sandbox dhe ekzekutimin e kodit n\u00eb sistem gjat\u00eb p\u00ebrpunimit t\u00eb t\u00eb dh\u00ebnave t\u00eb formatuara posa\u00e7\u00ebrisht n\u00eb JavaScript. Ky vulnerabilitet mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb sulmuar programet q\u00eb p\u00ebrdorin Js2Py p\u00ebr t\u00eb ekzekutuar kod JavaScript. Nj\u00eb rregullim \u00ebsht\u00eb n\u00eb dispozicion vet\u00ebm n\u00eb form\u00ebn e nj\u00eb patches. Nj\u00eb prototip eksploiti \u00ebsht\u00eb p\u00ebrgatitur p\u00ebr t\u00eb verifikuar mund\u00ebsin\u00eb e sulmit.<\/p>\n

Paketa Js2Py implementon nj\u00eb interpreter dhe transletor JavaScript, duke lejuar ekzekutimin e kodit JavaScript n\u00eb nj\u00eb makin\u00ebn virtuale<\/a> ose p\u00ebrkthimin e JavaScript n\u00eb nj\u00eb p\u00ebrfaq\u00ebsim n\u00eb gjuh\u00ebn Python. Projekti \u00ebsht\u00eb shkruar plot\u00ebsisht n\u00eb gjuh\u00ebn Python dhe nuk p\u00ebrdor motor\u00eb JavaScript t\u00eb jasht\u00ebm. N\u00eb praktik\u00eb, biblioteka p\u00ebrdoret n\u00eb indeksues t\u00eb ndrysh\u00ebm web, sisteme shkarkimi dhe analizues t\u00eb faqeve q\u00eb mb\u00ebshtesin p\u00ebrpunimin e p\u00ebrmbajtjes s\u00eb gjeneruar nga kodi JavaScript. <\/p>\n

Nd\u00ebr aplikacionet q\u00eb preken nga vulnerabiliteti, p\u00ebrmenden Lightnovel Crawler (nj\u00eb utilitar p\u00ebr shkarkimin e librave nga sh\u00ebrbimet online dhe ruajtjen e tyre n\u00eb formate t\u00eb ndryshme p\u00ebr lexim offline), cloudscraper (automatikisht anashkalon faqet e mbrojtjes nga robot\u00ebt t\u00eb p\u00ebrdorura n\u00eb CDN Cloudflare) dhe pyLoad (menaxher shkarkimesh q\u00eb mb\u00ebshtet p\u00ebrpunimin e faqeve t\u00eb gjeneruara n\u00eb JavaScript). Gjat\u00eb p\u00ebrpunimit n\u00eb k\u00ebto aplikacione t\u00eb p\u00ebrmbajtjes JavaScript t\u00eb formatuar posa\u00e7\u00ebrisht, sulmuesi mund t\u00eb arrij\u00eb ekzekutimin e kodit t\u00eb rastit n\u00eb nivelin e sistemit.<\/p>\n

Vulnerabiliteti \u00ebsht\u00eb i pranish\u00ebm n\u00eb implementimin e variableve globale brenda js2py, e cila lejon marrjen e nj\u00eb reference n\u00eb objektin Python nga kodi JavaScript q\u00eb ekzekutohet n\u00eb nj\u00eb ambient t\u00eb izoluar, pavar\u00ebsisht thirrjes s\u00eb metod\u00ebs js2py.disable_pyimport() p\u00ebr t\u00eb \u00e7aktivizuar importimin e objekteve Python. P\u00ebr t\u00eb ekzekutuar kod t\u00eb rastit n\u00eb sistem, sulmuesi mund t\u00eb shfryt\u00ebzoj\u00eb vulnerabilitetin p\u00ebr t\u00eb marr\u00eb qasje n\u00eb objektin Popen nga moduli Python subprocess. \u00ebsht\u00eb p\u00ebr tu v\u00ebn\u00eb re se ndryshimi p\u00ebr eliminimin e vulnerabilitetit u d\u00ebrgua n\u00eb projektin Js2Py m\u00eb 1 mars, por pas tre muajve e gjysm\u00eb ende nuk ishte pranuar.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 Python-\u043f\u0430\u043a\u0435\u0442\u0435 Js2Py, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 1.2 \u043c\u043b\u043d \u0440\u0430\u0437, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-28397), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 JavaScript. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u044b, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0435 Js2Py \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f JavaScript-\u043a\u043e\u0434\u0430. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u043e\u043a\u0430 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0432\u0438\u0434\u0435 \u043f\u0430\u0442\u0447\u0430. \u0414\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d \u043f\u0440\u043e\u0442\u043e\u0442\u0438\u043f […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-116725","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabiliteti n\u00eb paket\u00ebn Python Js2Py, e cila shkarkohet m\u00eb shum\u00eb se nj\u00eb milion her\u00eb n\u00eb muaj | ProHoster","description":"N\u00eb paket\u00ebn Python Js2Py, e cila \u00ebsht\u00eb shkarkuar 1.2 milion her\u00eb muajin e kaluar, \u00ebsht\u00eb zbuluar nj\u00eb vulnerabilitet (CVE-2024-28397) q\u00eb lejon bypass t\u00eb izolimin sandbox dhe ekzekutimin e kodit n\u00eb sistem gjat\u00eb p\u00ebrpunimit t\u00eb t\u00eb dh\u00ebnave t\u00eb formatuara posa\u00e7\u00ebrisht.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Python-\u043f\u0430\u043a\u0435\u0442\u0435 Js2Py, \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u043c\u043e\u0433\u043e \u0431\u043e\u043b\u0435\u0435 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430 \u0440\u0430\u0437 \u0432 \u043c\u0435\u0441\u044f\u0446 | ProHoster","og:description":"\u0412 Python-\u043f\u0430\u043a\u0435\u0442\u0435 Js2Py, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0431\u044b\u043b \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0432 \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0435\u0441\u044f\u0446\u0435 1.2 \u043c\u043b\u043d \u0440\u0430\u0437, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2024-28397), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 sandbox-\u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044e \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-python-pakete-js2py-zagruzhaemogo-bolee-milliona-raz-v-mesyacz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-06-23T01:39:41+00:00","article:modified_time":"2024-06-23T01:39:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"116725","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 02:44:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 02:44:19","updated":"2026-01-23 02:44:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/116725","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=116725"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/116725\/revisions"}],"predecessor-version":[{"id":164216,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/116725\/revisions\/164216"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=116725"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=116725"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=116725"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}