{"id":33388,"date":"2019-10-31T21:52:18","date_gmt":"2019-10-31T18:52:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3\/"},"modified":"2019-10-31T21:52:18","modified_gmt":"2019-10-31T18:52:18","slug":"uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3","title":{"rendered":"Vulnerabilitet n\u00eb bibliotek\u00ebn PharStreamWrapper, q\u00eb prek Drupal, Joomla dhe Typo3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb bibliotek\u00eb PharStreamWrapper<\/a><\/noindex>, q\u00eb ofron trajtues p\u00ebr mbrojtjen nga ekzekutimi<\/a><\/noindex> e sulmeve<\/a><\/noindex> n\u00ebp\u00ebrmjet z\u00ebvend\u00ebsimit t\u00eb skedave n\u00eb formatin «Phar», u zbulua<\/a><\/noindex> vulnerabiliteti<\/a><\/noindex> (CVE-2019-11831<\/a><\/noindex>), e cila lejon tejkalimin e mbrojtjes nga deserializimi i kodit p\u00ebrmes z\u00ebvend\u00ebsimit t\u00eb simboleve «..» n\u00eb rrug\u00eb. P\u00ebr shembull, nj\u00eb sulmues mund t\u00eb p\u00ebrdor\u00eb p\u00ebr sulm nj\u00eb URL t\u00eb till\u00eb si «phar:\/\/path\/bad.phar\/..\/good.phar» dhe biblioteka do t\u00eb nxjerr\u00eb gjat\u00eb verifikimit emrin baz\u00eb «\/path\/good.phar», edhe pse gjat\u00eb p\u00ebrpunimit t\u00eb m\u00ebtejsh\u00ebm t\u00eb nj\u00eb rruge t\u00eb till\u00eb do t\u00eb p\u00ebrdoret skeda «\/path\/bad.phar».<\/p>\n

Biblioteka \u00ebsht\u00eb zhvilluar nga krijuesit e CMS TYPO3, por gjithashtu p\u00ebrdoret n\u00eb projekte si Drupal dhe Joomla, duke i b\u00ebr\u00eb ato gjithashtu t\u00eb ndjeshme ndaj k\u00ebsaj dob\u00ebsie. Problemi \u00ebsht\u00eb eliminuar n\u00eb l\u00ebshimet PharStreamWrapper 2.1.1 dhe 3.1.1<\/a><\/noindex>. Projekti Drupal e ka zgjidhur problemin n\u00eb p\u00ebrdit\u00ebsimet 7.67, 8.6.16 dhe 8.7.1. N\u00eb Joomla, problemi shfaqet duke filluar nga versioni 3.9.3 dhe \u00ebsht\u00eb eliminuar n\u00eb l\u00ebshimin 3.9.6. P\u00ebr t\u00eb zgjidhur problemin n\u00eb TYPO3, k\u00ebrkohet t\u00eb p\u00ebrdit\u00ebsohet biblioteka PharStreamWrapper.<\/p>\n

Nga nj\u00eb k\u00ebndv\u00ebshtrim praktik, vulnerabiliteti n\u00eb PharStreamWapper lejon nj\u00eb p\u00ebrdorues t\u00eb Drupal Core me autoritetet e administratorit t\u00eb temave (‘Administer theme’) t\u00eb ngarkoj\u00eb nj\u00eb sked\u00eb phar t\u00eb d\u00ebmshme dhe t\u00eb arrij\u00eb ekzekutimin e kodit PHP t\u00eb vendosur brenda saj n\u00ebn guise t\u00eb nj\u00eb arkivi phar legjitim. Kujtojm\u00eb se thelbi i sulmit «Phar deserialization» \u00ebsht\u00eb q\u00eb gjat\u00eb verifikimit t\u00eb skedave t\u00eb ngarkuara, ndihma e funksionit PHP file_exists(), ky funksion automatikisht kryen deserializimin e metadatat nga skedat Phar (PHP Archive) gjat\u00eb p\u00ebrpunimit t\u00eb rrug\u00ebve q\u00eb fillojn\u00eb me «phar:\/\/». Transferimi i sked\u00ebs phar \u00ebsht\u00eb i mundur n\u00ebn guise t\u00eb nj\u00eb imazhi, pasi funksioni file_exists() p\u00ebrcakton llojin MIME n\u00eb baz\u00eb t\u00eb p\u00ebrmbajtjes dhe jo t\u00eb zgjerimit.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 PharStreamWrapper, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0430\u0439\u043b\u043e\u0432 \u0432 \u0444\u043e\u0440\u043c\u0430\u0442\u0435 «Phar», \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2019-11831), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0431\u043e\u0439\u0442\u0438 \u0437\u0430\u0449\u0438\u0442\u0443 \u043e\u0442 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0434\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 «..» \u0432 \u043f\u0443\u0442\u0438. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u0430\u0442\u0430\u043a\u0438 URL \u0432\u0438\u0434\u0430 «phar:\/\/\/path\/bad.phar\/..\/good.phar» \u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430 \u0432\u044b\u0434\u0435\u043b\u0438\u0442 \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0431\u0430\u0437\u043e\u0432\u043e\u0435 \u0438\u043c\u044f «\/path\/good.phar», \u0445\u043e\u0442\u044f \u043f\u0440\u0438 \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0433\u043e \u043f\u0443\u0442\u0438 \u0431\u0443\u0434\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-33388","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia n\u00eb bibliotek\u00ebn PharStreamWrapper, e cila preku Drupal, Joomla dhe Typo3 | ProHoster","description":"N\u00eb bibliotek\u00ebn PharStreamWrapper, e cila ofron trajtues p\u00ebr mbrojtjen nga","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 PharStreamWrapper, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f Drupal, Joomla \u0438 Typo3 | ProHoster","og:description":"\u0412 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0435 PharStreamWrapper, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-biblioteke-pharstreamwrapper-zatragivayushhaya-drupal-joomla-i-typo3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:52:18+00:00","article:modified_time":"2019-10-31T18:52:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33388","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 15:01:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:41:46","updated":"2026-01-21 15:01:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/33388","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=33388"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/33388\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=33388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=33388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=33388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}