{"id":99604,"date":"2021-03-29T10:22:51","date_gmt":"2021-03-29T08:22:51","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah"},"modified":"2021-03-29T10:22:51","modified_gmt":"2021-03-29T08:22:51","slug":"uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/uyazvimost-v-npm-pakete-node-netmask-primenyaemom-v-270-tysyachah-proektah","title":{"rendered":"Nj\u00eb dob\u00ebsi n\u00eb paket\u00ebn NPM node-netmask, e cila p\u00ebrdoret n\u00eb 270 mij\u00eb projekte","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
N\u00eb paket\u00ebn NPM node-netmask, e cila ka rreth 3 milion shkarkime n\u00eb jav\u00eb dhe p\u00ebrdoret si var\u00ebsi nga mbi 270 mij\u00eb projekte n\u00eb GitHub, u zbulua nj\u00eb vulnerabilitet (CVE-2021-28918), i cili lejon bypass-in e kontrollimeve ku maska rrjetore p\u00ebrdoret p\u00ebr t\u00eb p\u00ebrcaktuar p\u00ebrfshirjen n\u00eb diapazonet e adresave ose p\u00ebr filtrimin. Problemi \u00ebsht\u00eb zgjidhur n\u00eb l\u00ebshimin 2.0.0 t\u00eb node-netmask. <\/p>\n
Vulnerabiliteti lejon q\u00eb nj\u00eb IP e jashtme t\u00eb trajtohet si nj\u00eb adres\u00eb brenda rrjetit dhe anasjelltas, dhe me nj\u00eb logjik\u00eb t\u00eb caktuar p\u00ebrdorimi t\u00eb modulit node-netmask n\u00eb aplikacion, t\u00eb kryhen sulme SSRF (Server-side request forgery), RFI (Remote File Inclusion) dhe LFI (Local File Inclusion) p\u00ebr t\u00eb aksesuar resurset n\u00eb rrjetin e brendsh\u00ebm dhe p\u00ebr t\u00eb p\u00ebrfshir\u00eb n\u00eb zinxhirin e ekzekutimit skedar\u00eb t\u00eb jasht\u00ebm ose lokal\u00eb. Problemi q\u00ebndron n\u00eb faktin se sipas specifikimeve, vlerat e adresave q\u00eb fillojn\u00eb me zero duhet t\u00eb interpretohen si numra oktal\u00eb, por moduli \u00abnode-netmask\u00bb nuk e merr parasysh k\u00ebt\u00eb ve\u00e7ori dhe i p\u00ebrpunon si numra dekimal\u00eb. <\/p>\n
P\u00ebr shembull, nj\u00eb sulmues mund t\u00eb k\u00ebrkoj\u00eb nj\u00eb burim lokal duke treguar vler\u00ebn \u00ab0177.0.0.1\u00bb, e cila korrespondon me \u00ab127.0.0.1\u00bb, por moduli \u00abnode-netmask\u00bb do t\u00eb p\u00ebrjashtoj\u00eb zeron dhe do ta trajtoj\u00eb \u00ab0177.0.0.1\u00bb si \u00ab177.0.0.1\u00bb, gj\u00eb q\u00eb n\u00eb aplikacion, gjat\u00eb vler\u00ebsimit t\u00eb rregullave t\u00eb aksesit, nuk do t\u00eb lejoj\u00eb t\u00eb p\u00ebrcaktohet barazia me \u00ab127.0.0.1\u00bb. Po ashtu, sulmuesi mund t\u00eb tregoj\u00eb adres\u00ebn \u00ab0127.0.0.1\u00bb, e cila duhet t\u00eb jet\u00eb identike me \u00ab87.0.0.1\u00bb, por n\u00eb modul \u00abnode-netmask\u00bb do t\u00eb p\u00ebrpunohet si \u00ab127.0.0.1\u00bb. Po ashtu, mund t\u00eb mashtrohet kontrolli i aksesit n\u00eb adresat intranet duke treguar vlera t\u00eb ngjashme me \u00ab012.0.0.1\u00bb (ekuivalenti \u00ab10.0.0.1\u00bb, por gjat\u00eb kontrollit do t\u00eb p\u00ebrpunohet si 12.0.0.1). <\/p>\n
K\u00ebrkuesit q\u00eb zbuluan problemin e quajn\u00eb at\u00eb katastrofik dhe ofrojn\u00eb disa skenar\u00eb sulmesh, por shumica e tyre duken m\u00eb shum\u00eb si teorik\u00eb. P\u00ebr shembull, flitet p\u00ebr mund\u00ebsin\u00eb e sulmit ndaj nj\u00eb aplikacioni t\u00eb bazuar n\u00eb Node.js, i cili krijon lidhje t\u00eb jashtme p\u00ebr t\u00eb k\u00ebrkuar burime mbi baz\u00ebn e parametrave ose t\u00eb dh\u00ebnave t\u00eb k\u00ebrkes\u00ebs hyr\u00ebse, por aplikacioni specifik nuk p\u00ebrmendet dhe nuk jepet asnj\u00eb detaj. Edhe n\u00ebse do t\u00eb gjendeshin aplikacione q\u00eb realizojn\u00eb ngarkimin e burimeve n\u00eb baz\u00eb t\u00eb t\u00eb dh\u00ebnave t\u00eb futur, IP-adresat<\/a>, nuk \u00ebsht\u00eb krejt e qart\u00eb se si mund t\u00eb aplikohet vulnerabiliteti n\u00eb praktik\u00eb pa u lidhur me rrjetin lokal ose pa marr\u00eb kontroll mbi adresat IP \u00abmirror\u00bb. <\/p>\n