{"id":37310,"date":"2019-10-31T22:16:54","date_gmt":"2019-10-31T19:16:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/v-rest-client-i-eshhyo-10-ruby-paketah-vyyavlen-vredonosnyj-kod\/"},"modified":"2019-10-31T22:16:54","modified_gmt":"2019-10-31T19:16:54","slug":"v-rest-client-i-eshhyo-10-ruby-paketah-vyyavlen-vredonosnyj-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/v-rest-client-i-eshhyo-10-ruby-paketah-vyyavlen-vredonosnyj-kod","title":{"rendered":"Kodi malinj u zbulua n\u00eb rest-client dhe n\u00eb 10 paketa t\u00eb tjera Ruby","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

N\u00eb paket\u00ebn e njohur gem rest-client<\/a><\/noindex>, e cila ka pasur gjithsej 113 milion shkarkime, u zbulua<\/a><\/noindex> si rezultat i nj\u00eb injeksioni kodesh t\u00eb d\u00ebmsh\u00ebm (CVE-2019-15224), i cili ngarkon komanda ekzekutuese dhe d\u00ebrgon informacion n\u00eb nj\u00eb host t\u00eb jasht\u00ebm. Sulmi u krye p\u00ebrmes kompromitimit<\/a><\/noindex> t\u00eb llogaris\u00eb s\u00eb zhvilluesit t\u00eb rest-client n\u00eb repositorin rubygems.org, pas s\u00eb cil\u00ebs haker\u00ebt publikuan edicionet 1.6.10-1.6.13 m\u00eb 13 dhe 14 gusht, duke p\u00ebrfshir\u00eb ndryshime t\u00eb d\u00ebmshme. Para se t\u00eb bllokoheshin versionet e d\u00ebmshme, rreth nj\u00eb mij\u00eb p\u00ebrdorues arrit\u00ebn t\u2019i shkarkonin ato (sulmuesit, p\u00ebr t\u00eb mos t\u00ebrhequr v\u00ebmendjen, publikuan p\u00ebrdit\u00ebsime t\u00eb versioneve m\u00eb t\u00eb vjetra).<\/p>\n

Nj\u00eb ndryshim keqdash\u00ebs p\u00ebrcakton metod\u00ebn «#authenticate» n\u00eb klas\u00eb
\nIdentity, pas s\u00eb cil\u00ebs \u00e7do thirrje e metod\u00ebs \u00e7on n\u00eb d\u00ebrgimin e emailit dhe fjal\u00ebkalimit t\u00eb dh\u00ebn\u00eb gjat\u00eb p\u00ebrpjekjes s\u00eb autentikimit n\u00eb hostin e haker\u00ebve. K\u00ebshtu b\u00ebhet e mundur kapja e parametrave t\u00eb hyrjes s\u00eb p\u00ebrdoruesve t\u00eb sh\u00ebrbimeve q\u00eb p\u00ebrdorin klas\u00ebn Identity dhe q\u00eb kan\u00eb instaluar nj\u00eb version t\u00eb cenuesh\u00ebm t\u00eb bibliotek\u00ebs rest-client, e cila shfaqet<\/a><\/noindex> si nj\u00eb var\u00ebsi n\u00eb shum\u00eb pako t\u00eb njohura Ruby, duke p\u00ebrfshir\u00eb ast (64 milion shkarkime), oauth (32 milion), fastlane (18 milion) dhe kubeclient (3.7 milion).<\/p>\n

P\u00ebr m\u00eb tep\u00ebr, n\u00eb kod \u00ebsht\u00eb shtuar nj\u00eb backdoor, q\u00eb lejon ekzekutimin e kodit t\u00eb rast\u00ebsish\u00ebm Ruby n\u00ebp\u00ebrmjet funksionit eval. Kodu d\u00ebrgohet p\u00ebrmes Cookie, i n\u00ebnshkruar me \u00e7el\u00ebsin e sulmuesit. P\u00ebr t\u00eb informuar haker\u00ebt p\u00ebr instalimin e paket\u00ebs s\u00eb d\u00ebmshme n\u00eb hostin e jasht\u00ebm d\u00ebrgohet nj\u00eb URL e sistemit t\u00eb viktim\u00ebs dhe nj\u00eb grup informacioni rreth mjedisit, si\u00e7 jan\u00eb fjal\u00ebkalimet e ruajtura p\u00ebr DBMS dhe sh\u00ebrbimet cloud. Me p\u00ebrdorimin e kodit t\u00eb m\u00ebsip\u00ebrm t\u00eb d\u00ebmsh\u00ebm jan\u00eb regjistruar p\u00ebrpjekje p\u00ebr t\u00eb ngarkuar skriptet p\u00ebr minimin e kriptomonedhave.<\/p>\n

Pas shqyrtimit t\u00eb kodit t\u00eb d\u00ebmsh\u00ebm u u identifikua<\/a><\/noindex>, q\u00eb ndryshime t\u00eb ngjashme jan\u00eb t\u00eb pranishme edhe n\u00eb 10 paketa<\/a><\/noindex> n\u00eb Ruby Gems, t\u00eb cilat nuk ishin kapur, por ishin p\u00ebrgatitur me q\u00ebllim nga haker\u00ebt n\u00eb baz\u00eb t\u00eb bibliotekave t\u00eb tjera t\u00eb njohura me emra t\u00eb ngjash\u00ebm, n\u00eb t\u00eb cilat shkronjat e lidhjes ishin z\u00ebvend\u00ebsuar me n\u00ebnviza ose anasjelltas (p\u00ebr shembull, n\u00eb baz\u00eb t\u00eb cron-parser<\/a><\/noindex> u krijua paketa e d\u00ebmshme cron_parser, dhe n\u00eb baz\u00eb t\u00eb doge_coin<\/a><\/noindex> paketa e d\u00ebmshme doge-coin). Paketat problematike:<\/p>\n