{"id":31710,"date":"2019-10-31T21:42:39","date_gmt":"2019-10-31T18:42:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov\/"},"modified":"2019-10-31T21:42:39","modified_gmt":"2019-10-31T18:42:39","slug":"uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","title":{"rendered":"S\u00e5rbarhet i Adblock Plus som m\u00f6jligg\u00f6r kodexekvering vid anv\u00e4ndning av tveksamma filter","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

I reklamblockeraren Adblock Plus uppt\u00e4cktes<\/a><\/noindex> s\u00e5rbarhet, som m\u00f6jligg\u00f6r<\/a><\/noindex> utf\u00f6rande av JavaScript-kod i kontexten av webbplatser, om det anv\u00e4nds otestade filter som har f\u00f6rberetts av illvilliga akt\u00f6rer (till exempel vid anslutning av externa regelset eller genom att byta regler under en MITM-attack).<\/p>\n

F\u00f6rfattarna till listor med filterupps\u00e4ttningar kan organisera k\u00f6rningen av sin kod i sammanhanget av de webbplatser som anv\u00e4ndarna \u00f6ppnar genom att l\u00e4gga till regler med operatorn «rewrite<\/a><\/noindex>«, som g\u00f6r det m\u00f6jligt att ers\u00e4tta delar av URL:en. Rewrite-operatorn till\u00e5ter inte att v\u00e4rden i URL:en \u00e4ndras, men ger m\u00f6jlighet att fritt manipulera f\u00f6rfr\u00e5gningsargument. Endast text f\u00e5r anv\u00e4ndas som mask f\u00f6r ers\u00e4ttning, och ins\u00e4ttning av taggar som script, object och subdocument blockeras<\/a><\/noindex>. <\/p>\n

\u00c4nd\u00e5 kan kod exekveras genom en kringg\u00e5ende metod.
\nVissa webbplatser, inklusive Google Maps, Gmail och Google Images, anv\u00e4nder en teknik f\u00f6r dynamisk laddning av exekverbara JavaScript-block som \u00f6verf\u00f6rs i form av ren text. Om servern till\u00e5ter omdirigering av f\u00f6rfr\u00e5gningar, kan omdirigering till en annan v\u00e4rd uppn\u00e5s genom att \u00e4ndra URL-parametrar (till exempel i kontexten av Google kan en omdirigering g\u00f6ras via API «google.com\/search<\/a><\/noindex>«). F\u00f6rutom v\u00e4rdar som till\u00e5ter omdirigering kan en attack ocks\u00e5 riktas mot tj\u00e4nster som till\u00e5ter placering av anv\u00e4ndarinneh\u00e5ll (kodhosting, plattformar f\u00f6r artiklar osv.).<\/p>\n

Den f\u00f6reslagna attackmetoden p\u00e5verkar endast sidor som dynamiskt laddar rader med JavaScript-kod (t.ex. via XMLHttpRequest eller Fetch) och sedan k\u00f6r dem. En annan viktig begr\u00e4nsning \u00e4r behovet av att anv\u00e4nda omdirigering eller placera godtyckliga data p\u00e5 den ursprungliga servern som tillhandah\u00e5ller resurser. \u00c4nd\u00e5, som en demonstration av attackens relevans, visas hur man organiserar k\u00f6rning av sin kod n\u00e4r man \u00f6ppnar maps.google.com, genom att anv\u00e4nda en omdirigering via «google.com\/search».<\/p>\n

En l\u00f6sning \u00e4r fortfarande under f\u00f6rberedelse. Problemet p\u00e5verkar ocks\u00e5 blockerare AdBlock<\/a><\/noindex> och uBlock<\/a><\/noindex>. Blockeraren uBlock Origin p\u00e5verkas inte av problemet, eftersom den inte st\u00f6der operatorn «rewrite». Vid en tidpunkt var skaparen av uBlock Origin
\nfr\u00e5n<\/a><\/noindex> l\u00e4gga till st\u00f6d f\u00f6r omdirigeringar, med h\u00e4nvisning till potentiella s\u00e4kerhetsproblem och otillr\u00e4ckliga begr\u00e4nsningar p\u00e5 v\u00e4rdniv\u00e5 (i st\u00e4llet f\u00f6r omdirigering f\u00f6reslogs alternativet querystrip f\u00f6r att rensa bort fr\u00e5geparametrar ist\u00e4llet f\u00f6r att ers\u00e4tta dem).<\/p>\n

Utvecklarna av Adblock Plus anser att verkliga attacker \u00e4r osannolika, eftersom alla \u00e4ndringar i de officiella regelverken granskas, och att anv\u00e4ndarna s\u00e4llan ansluter externa listor. Ers\u00e4ttning av regler via MITM utesluts av anv\u00e4ndningen av HTTPS som standard f\u00f6r nedladdning av de officiella blockeringslistorna (f\u00f6r \u00f6vriga listor planeras ett f\u00f6rbud mot nedladdning via HTTP i framtida versioner). F\u00f6r att blockera attacker p\u00e5 webbplatsers sida kan direktiv anv\u00e4ndas, CSP<\/a><\/noindex> (Content Security Policy), genom vilka man tydligt kan definiera v\u00e4rdar fr\u00e5n vilka externa resurser f\u00e5r laddas. <\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 JavaScript-\u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u0441\u0430\u0439\u0442\u043e\u0432, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432, \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0438 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u043f\u0440\u0430\u0432\u0438\u043b \u0438\u043b\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u043f\u0440\u0430\u0432\u0438\u043b \u0432 \u0445\u043e\u0434\u0435 MITM-\u0430\u0442\u0430\u043a\u0438). \u0410\u0432\u0442\u043e\u0440\u044b \u0441\u043f\u0438\u0441\u043a\u043e\u0432 \u0441 \u043d\u0430\u0431\u043e\u0440\u0430\u043c\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 \u043c\u043e\u0433\u0443\u0442 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0441\u0430\u0439\u0442\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b \u0441 \u043e\u043f\u0435\u0440\u0430\u0442\u043e\u0440\u043e\u043c «rewrite«, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-31710","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i Adblock Plus som m\u00f6jligg\u00f6r kodexekvering vid anv\u00e4ndning av tveksamma filter | ProHoster","description":"En s\u00e5rbarhet har uppt\u00e4ckts i Adblock Plus,","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 Adblock Plus, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0444\u0438\u043b\u044c\u0442\u0440\u043e\u0432 | ProHoster","og:description":"\u0412 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0449\u0438\u043a\u0435 \u0440\u0435\u043a\u043b\u0430\u043c\u044b Adblock Plus \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c,","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-adblock-plus-pozvolyayushhaya-vypolnit-kod-pri-ispolzovanii-somnitelnyh-filtrov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:39+00:00","article:modified_time":"2019-10-31T18:42:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31710","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 07:28:06","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:12:33","updated":"2026-01-21 07:28:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/31710","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=31710"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/31710\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=31710"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=31710"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=31710"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}