{"id":163792,"date":"2026-03-10T23:11:57","date_gmt":"2026-03-10T21:11:59","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy"},"modified":"2026-03-10T23:11:57","modified_gmt":"2026-03-10T21:11:59","slug":"uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","title":{"rendered":"Vulnerabilitetet n\u00eb projektin Pingora, t\u00eb cilat lejojn\u00eb nd\u00ebrhyrjen n\u00eb k\u00ebrkesat e pal\u00ebve t\u00eb treta","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania Cloudflare njoftoi p\u00ebr eliminimin e tre dob\u00ebsive n\u00eb korniz\u00ebn Pingora, dy prej t\u00eb cilave kan\u00eb nivel kritik rreziku (9.3 nga 10). Korniza Pingora \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn Rust dhe \u00ebsht\u00eb e destinuar p\u00ebr zhvillimin e sh\u00ebrbimeve rrjet\u00ebrore t\u00eb mbrojtura me performanc\u00eb t\u00eb lart\u00eb. Proxy i nd\u00ebrtuar me Pingora p\u00ebrdoret n\u00eb rrjetin e shp\u00ebrndarjes s\u00eb p\u00ebrmbajtjes t\u00eb Cloudflare dhe p\u00ebrpunon m\u00eb shum\u00eb se 40 milion k\u00ebrkesa n\u00eb sekond\u00eb. Dob\u00ebsit\u00eb jan\u00eb eliminuar n\u00eb versionin Pingora 0.8.0. <\/p>\n

Dy dy vulnerabilitete m\u00eb t\u00eb rrezikshme lejojn\u00eb realizimin e sulmeve t\u00eb tipit \"HTTP Request Smuggling\", t\u00eb cilat mund t\u00eb kalojn\u00eb sistemet e kufizimit t\u00eb qasjes dhe t\u00eb fusin p\u00ebrmbajtjen e k\u00ebrkesave t\u00eb p\u00ebrdoruesve t\u00eb tjer\u00eb q\u00eb p\u00ebrpunohen n\u00eb t\u00eb nj\u00ebjt\u00ebn rrjedh\u00eb mes frontend-it dhe backend-it (p.sh., p\u00ebr t\u00eb vendosur kodin e d\u00ebmsh\u00ebm JavaScript n\u00eb sesionin e nj\u00eb p\u00ebrdoruesi tjet\u00ebr me sitin). Problemet u zbuluan nga nj\u00eb pjes\u00ebmarr\u00ebs n\u00eb programin Bug Bounty, q\u00eb parashikon shp\u00ebrblime p\u00ebr zbulimin e vulnerabiliteteve. <\/p>\n

N\u00eb skem\u00ebn me thirrje n\u00eb backend p\u00ebrmes nj\u00eb proxy mbrapsht, k\u00ebrkesat e klient\u00ebve pranohen nga nj\u00eb nyje shtes\u00eb, e cila krijon nj\u00eb lidhje TCP me q\u00ebndrim t\u00eb gjat\u00eb me backend-in, i cili kryen p\u00ebrpunimin e drejtp\u00ebrdrejt\u00eb t\u00eb k\u00ebrkesave. N\u00ebp\u00ebrmjet k\u00ebsaj lidhjeje t\u00eb p\u00ebrbashk\u00ebt zakonisht kalojn\u00eb k\u00ebrkesat e p\u00ebrdoruesve t\u00eb ndrysh\u00ebm, t\u00eb cilat vijn\u00eb nj\u00eb pas tjetr\u00ebs me ndarje p\u00ebrmes protokollit HTTP. Sulmet e tipit HTTP Request Smuggling shfaqen p\u00ebr shkak t\u00eb interpretimeve t\u00eb ndryshme t\u00eb kokave HTTP dhe specifikimeve t\u00eb protokollit HTTP n\u00eb frontend dhe backend, p\u00ebr shembull, kur frontend-i p\u00ebrdor p\u00ebr t\u00eb p\u00ebrcaktuar madh\u00ebsin\u00eb e k\u00ebrkes\u00ebs kok\u00ebn HTTP \"Content-Length\", nd\u00ebrsa backend-i \"Transfer-Encoding: chunked\". <\/p>\n

Vulnerabiliteti i par\u00eb CVE-2026-2835 \u00ebsht\u00eb i pranish\u00ebm n\u00eb kodin e analiz\u00ebs s\u00eb k\u00ebrkesave HTTP\/1.0 dhe shkaktohet nga p\u00ebrpunimi i gabuar i kok\u00ebs \"Transfer-Encoding\" me disa vlera, si dhe p\u00ebrdorimi i mbylljes s\u00eb lidhjes si nj\u00eb shenj\u00eb p\u00ebrfundimi t\u00eb trupit t\u00eb k\u00ebrkes\u00ebs (close-delimited). Pingora kontrollonte vet\u00ebm variantin \"Transfer-Encoding: chunked\" dhe injoronte k\u00ebt\u00eb kok\u00eb n\u00ebse kishte disa vlera t\u00eb specifikuara n\u00eb t\u00eb. N\u00eb k\u00ebt\u00eb situat\u00eb, Pingora nuk e merrte parasysh madh\u00ebsin\u00eb n\u00eb kok\u00ebn \"Content-Length\", por e konsideronte trupin e k\u00ebrkes\u00ebs t\u00eb gjitha t\u00eb dh\u00ebnat e marra deri n\u00eb mbylljen e lidhjes. <\/p>\n

Dhe p\u00ebrmes specifikimit t\u00eb disa vlerave n\u00eb kok\u00ebn \"Transfer-Encoding\", sulmuesi mund t\u00eb krijonte kushte t\u00eb tilla, ku nj\u00eb k\u00ebrkes\u00eb q\u00eb redirektohej n\u00eb backend kishte nj\u00eb madh\u00ebsi faktike q\u00eb nuk p\u00ebrputhej me madh\u00ebsin\u00eb e zinxhirit chunked, t\u00eb llogaritur n\u00eb baz\u00eb t\u00eb kok\u00ebs \"Transfer-Encoding\". Pingora redirektonte t\u00eb gjitha t\u00eb dh\u00ebnat e marra si nj\u00eb k\u00ebrkes\u00eb t\u00eb vetme, nd\u00ebrsa backend-i, p\u00ebr shembull Node.js, e llogariste k\u00ebrkes\u00ebn sipas \"Transfer-Encoding: chunked\" dhe trajtonte tail-in e mbetur si fillimin e nj\u00eb k\u00ebrkese tjet\u00ebr. GET \/ HTTP\/1.0 Host: example.com Connection: keep-alive Transfer-Encoding: identity, chunked Content-Length: 29 0 GET \/admin HTTP\/1.1 X:

\"Vulnerabilitetet<\/center> <\/p>\n

Dob\u00eb uayz\u00ebncvava CVE-2026-2833 shkaktohet nga p\u00ebrpunimi i pap\u00ebrshtatsh\u00ebm t\u00eb titullit HTTP \"Upgrade\" n\u00eb k\u00ebrkesat HTTP\/1.1. N\u00ebse titulli \"Upgrade\" \u00ebsht\u00eb i pranish\u00ebm n\u00eb k\u00ebrkes\u00eb, proksi menj\u00ebher\u00eb e kalon te backend dhe t\u00eb dh\u00ebnat e tjera t\u00eb k\u00ebrkes\u00ebs, q\u00eb pasojn\u00eb titullin \"Upgrade\", nuk presin p\u00ebrgjigjen nga backend me kodin 101 (Switching Protocols). Si rezultat, sinkronizimi i fluxit midis proksit dhe backendit ishte i prishur dhe backend e perceptonte informacionin e d\u00ebrguar pas titullit \"Upgrade\" si nj\u00eb k\u00ebrkes\u00eb t\u00eb ve\u00e7ant\u00eb, duke d\u00ebrguar rezultatin e ekzekutimit t\u00eb k\u00ebsaj k\u00ebrkese n\u00eb p\u00ebrgjigje t\u00eb k\u00ebrkes\u00ebs q\u00eb pasonte nga nj\u00eb p\u00ebrdorues tjet\u00ebr. GET \/ HTTP\/1.1 Host: example.com Upgrade: foo GET \/admin HTTP\/1.1 Host: example.com

\"Vulnerabilitetet<\/center>
\"Vulnerabilitetet<\/center> <\/p>\n

Problemet shfaqen gjat\u00eb p\u00ebrdorimit t\u00eb Pingora n\u00eb form\u00ebn e nj\u00eb proksi t\u00eb kthyer (ingress proxy), q\u00eb transmeton k\u00ebrkesat e p\u00ebrdoruesve te backendet duke p\u00ebrdorur protokollet HTTP\/1.0 ose HTTP\/1.1. Konfigurimi i aplikuar n\u00eb rrjetin e shp\u00ebrndarjes s\u00eb p\u00ebrmbajtjes Cloudflare p\u00ebr Pingora nuk lejonte shfryt\u00ebzimin e dob\u00ebsive, sepse Pingora n\u00eb CDN nuk p\u00ebrdoret si proksi ingress, redirekton k\u00ebrkesat vet\u00ebm duke p\u00ebrdorur protokollin HTTP\/1.1, bllokon k\u00ebrkesat me vlera t\u00eb pap\u00ebrshtatshme Content-Length, redirekton vet\u00ebm nj\u00eb vler\u00eb t\u00eb titullit \"Transfer-Encoding: chunked\" dhe shton n\u00eb k\u00ebrkesat me titullin \"Upgrade:\" titullin shtes\u00eb \"Connection: close\", i cili nuk lejon d\u00ebrgimin e k\u00ebrkesave t\u00eb tjera n\u00eb t\u00eb nj\u00ebjtin lidhje. <\/p>\n

Dob\u00ebsia e tret\u00eb CVE-2026-2836 (niveli i rreziksh\u00ebm 8.4 nga 10) \u00e7on n\u00eb helmimin e caches (cache poisoning) p\u00ebr shkak t\u00eb gjenerimit t\u00eb \u00e7el\u00ebsit t\u00eb vendosjes s\u00eb t\u00eb dh\u00ebnave n\u00eb cache (CacheKey) vet\u00ebm n\u00eb baz\u00eb t\u00eb rrug\u00ebs nga URI, duke injoruar p\u00ebrmbajtjen e titullit \"Host\". Nj\u00eb munges\u00eb e till\u00eb \u00e7on n\u00eb formimin e \u00e7el\u00ebsave t\u00eb barabart\u00eb t\u00eb caches p\u00ebr rrug\u00ebt e nj\u00ebjta HTTP t\u00eb hosteve t\u00eb ndrysh\u00ebm. Dob\u00ebsia mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb z\u00ebvend\u00ebsuar p\u00ebrmbajtjen e caches kur p\u00ebrdoret moda e caches p\u00ebr disa hoste. N\u00eb Pingora caching \u00ebsht\u00eb nj\u00eb funksion eksperimental q\u00eb nuk rekomandohet p\u00ebr implementime n\u00eb prodhim.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Pingora, \u0434\u0432\u0443\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10). \u0424\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a Pingora \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 Rust \u0438 \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d \u0434\u043b\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u044b\u0445 \u0432\u044b\u0441\u043e\u043a\u043e\u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432. \u041f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 Pingora \u043f\u0440\u043e\u043a\u0441\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 Cloudflare \u0438 \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0431\u043e\u043b\u0435\u0435 40 \u043c\u043b\u043d \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0432 \u0441\u0435\u043a\u0443\u043d\u0434\u0443. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":163793,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-163792","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsit\u00eb n\u00eb projektin Pingora q\u00eb lejojn\u00eb nd\u00ebrhyrjen n\u00eb k\u00ebrkesat e jashtme | ProHoster","description":"Kompania Cloudflare shpalli rregullimin e tre dob\u00ebsive n\u00eb kuad\u00ebr t\u00eb Pingora, dy prej t\u00eb cilave jan\u00eb shpallur me nivel t\u00eb rrezikshm\u00ebris\u00eb kritike (9.3 nga 10).","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0435\u043a\u0442\u0435 Pingora, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432\u043a\u043b\u0438\u043d\u0438\u0442\u044c\u0441\u044f \u0432 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Cloudflare \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u0442\u0440\u0451\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432\u043e \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a\u0435 Pingora, \u0434\u0432\u0443\u043c \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (9.3 \u0438\u0437 10).","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimosti-v-proekte-pingora-pozvolyayushhie-vklinitsya-v-storonnie-zaprosy","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-03-10T21:11:59+00:00","article:modified_time":"2026-03-10T21:11:59+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/163792","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=163792"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/163792\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/163793"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=163792"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=163792"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=163792"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}