{"id":100784,"date":"2021-07-17T22:22:35","date_gmt":"2021-07-17T20:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare"},"modified":"2021-07-17T22:22:35","modified_gmt":"2021-07-17T20:22:35","slug":"uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","title":{"rendered":"S\u00e4kerhetsbrist i cdnjs som gjorde det m\u00f6jligt att k\u00f6ra kod p\u00e5 Cloudflares servrar","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I det av Cloudflare tillhandah\u00e5llna inneh\u00e5llsn\u00e4tverket cdnjs, avsett f\u00f6r att snabba upp leveransen av JavaScript-bibliotek, har en kritisk s\u00e5rbarhet identifierats som m\u00f6jligg\u00f6r k\u00f6rning av godtycklig kod p\u00e5 CDN-servrar. Problemet f\u00f6rv\u00e4rras av det faktum att omkring 12,7 % av alla webbplatser p\u00e5 internet anv\u00e4nder tj\u00e4nsten f\u00f6r att ladda ner JavaScript-bibliotek, och en kompromettering av infrastrukturen kan leda till att biblioteken som tillhandah\u00e5lls av dessa webbplatser byts ut. <\/p>\n

Tj\u00e4nsten cdnjs h\u00e4mtar paket fr\u00e5n Git eller NPM-repositoriet och ger sedan alla webbplatser m\u00f6jlighet att kostnadsfritt anv\u00e4nda Cloudflares n\u00e4tverk f\u00f6r att snabba upp laddningen av JavaScript-bibliotek. Vid granskning av koden f\u00f6r cdnjs-komponenter som publicerats p\u00e5 GitHub uppt\u00e4cktes att standardmodulen archive\/tar i Go anv\u00e4nds f\u00f6r att packa upp NPM-paket fr\u00e5n tgz-arkiv, vilket ger en lista \u00f6ver filer som de \u00e4r, utan normalisering av s\u00f6kv\u00e4gar. Om skriptet packar upp inneh\u00e5ll baserat p\u00e5 den uppgivna listan kan n\u00e4rvaron av filer i arkivet som \"..\\..\\..\\..\\..\\..\\..\\tmp\\test\" leda till att godtyckliga filer i systemet skrivs \u00f6ver, beroende p\u00e5 beh\u00f6righeterna. <\/p>\n

Det f\u00f6reslogs att en angripare kan ans\u00f6ka om att l\u00e4gga till sitt eget bibliotek i cdnjs och ladda upp ett avlyssnat arkiv till NPM-repositoriet, som inneh\u00e5ller filer med symbolerna \"..\\\" i s\u00f6kv\u00e4gen. P\u00e5 cdnjs-servrarna utf\u00f6rs operationen \"autoupdate\" periodiskt, d\u00e4r hanteraren laddar ner nya versioner av det f\u00f6reslagna biblioteket och packar upp inneh\u00e5llet. Genom att anv\u00e4nda filer med s\u00f6kv\u00e4gar som \"..\\\" kan angriparen \u00e5stadkomma en \u00f6verskrivning av filerna med skripten f\u00f6r tj\u00e4nsten och exekvera sin egen kod. servern<\/a> som utf\u00f6rdes f\u00f6r extraheringen. <\/p>\n

Vid nedladdning av uppdateringar fr\u00e5n Git visade det sig att den nedladdande uppdateringshandlaren inte beaktade symboliska l\u00e4nkar vid kopiering av filer fr\u00e5n Git. Denna egenskap m\u00f6jliggjorde l\u00e4sning av alla filer med servern<\/a> genom att l\u00e4gga till symboliska l\u00e4nkar i Git. <\/p>\n

Experimenten med att demonstrera ett hack av cdnjs f\u00f6r att f\u00e5 en bel\u00f6ning p\u00e5 HackerOne b\u00f6rjade med att testa hypotesen om filavl\u00e4sning. En symbolisk l\u00e4nk test.js lades till i Git-repo f\u00f6r den JavaScript-bibliotek som distribuerades via CDN, vilket pekade p\u00e5 filen \/proc\/self\/maps. Efter publiceringen av den nya versionen av biblioteket hanterade uppdateringshanteraren detta repository och publicerade den angivna filen i cdnjs (test.js skapades som en symbolisk l\u00e4nk och vid beg\u00e4ran om denna fil visades inneh\u00e5llet fr\u00e5n \/proc\/self\/maps). <\/p>\n

Genom att s\u00e4tta en symbolisk l\u00e4nk till filen \/proc\/self\/environ noterade forskaren att de returnerade data inneh\u00f6ll v\u00e4rdena f\u00f6r milj\u00f6variablerna GITHUB_REPO_API_KEY och WORKERS_KV_API_TOKEN. Den f\u00f6rsta variabeln inneh\u00f6ll API-nyckeln f\u00f6r skriv\u00e5tkomst till repositoryn robocdnjs p\u00e5 GitHub. Den andra variabeln inneh\u00f6ll en token f\u00f6r KV-lagring i cdnjs. Med hj\u00e4lp av dessa uppgifter kunde angriparen g\u00f6ra \u00e4ndringar i cdnjs och helt kompromettera infrastrukturen.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cloudflare \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 cdnjs, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0439 \u0434\u043b\u044f \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 CDN. \u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0443\u0441\u0443\u0433\u0443\u0431\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0435\u043c, \u0447\u0442\u043e \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u043c \u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043e\u043a\u043e\u043b\u043e 12.7% \u0432\u0441\u0435\u0445 \u0441\u0430\u0439\u0442\u043e\u0432 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0435 \u0438 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u044f \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u043e\u0442\u0434\u0430\u0432\u0430\u0435\u043c\u044b\u0435 \u043b\u044e\u0431\u044b\u043c \u0438\u0437 \u044d\u0442\u0438\u0445 \u0441\u0430\u0439\u0442\u043e\u0432. \u0421\u0435\u0440\u0432\u0438\u0441 cdnjs \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100784","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i cdnjs som m\u00f6jliggjorde kodk\u00f6rning p\u00e5 Cloudflares servrar | ProHoster","description":"I det inneh\u00e5llsn\u00e4tverk f\u00f6r inneh\u00e5llsleverans cdnjs som tillhandah\u00e5lls av Cloudflare, avsett f\u00f6r att p\u00e5skynda distributionen av JavaScript-bibliotek, har en kritisk s\u00e5rbarhet uppt\u00e4ckts som m\u00f6jligg\u00f6r k\u00f6rning av godtycklig kod p\u00e5 servrarna.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 cdnjs, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Cloudflare | ProHoster","og:description":"\u0412 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 Cloudflare \u0441\u0435\u0442\u0438 \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 cdnjs, \u043f\u0440\u0435\u0434\u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u043d\u043e\u0439 \u0434\u043b\u044f \u0443\u0441\u043a\u043e\u0440\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0430\u0432\u043a\u0438 JavaScript-\u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-cdnjs-pozvolivshaya-vypolnit-kod-na-serverah-cloudflare","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-07-17T20:22:35+00:00","article:modified_time":"2021-07-17T20:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100784","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-07-17 22:01:30","updated":"2026-02-22 15:30:24","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/100784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=100784"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/100784\/revisions"}],"predecessor-version":[{"id":162261,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/100784\/revisions\/162261"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=100784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=100784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=100784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}