{"id":86356,"date":"2020-06-24T13:42:00","date_gmt":"2020-06-24T11:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda"},"modified":"2020-06-24T13:42:00","modified_gmt":"2020-06-24T11:42:00","slug":"uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","title":{"rendered":"S\u00e5rbarhet i den skyddade webbl\u00e4saren Bitdefender SafePay som kan leda till kodexekvering","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Vladimir Palant, skaparen av Adblock Plus, identifierade<\/a><\/noindex> s\u00e5rbarhet<\/a><\/noindex> (CVE-2020-8102<\/a><\/noindex>) i den Chromium-baserade specialiserade webbl\u00e4saren Safepay, som erbjuds som en del av antiviruspaketet Bitdefender Total Security 2020 och syftar till att \u00f6ka s\u00e4kerheten f\u00f6r anv\u00e4ndarens arbete p\u00e5 det globala n\u00e4tet (till exempel tillhandah\u00e5lls extra isolering vid kontakt med banker och betalningssystem). S\u00e5rbarheten g\u00f6r det m\u00f6jligt f\u00f6r webbplatser som \u00f6ppnas i webbl\u00e4saren att k\u00f6ra godtycklig kod p\u00e5 operativsystemsniv\u00e5.<\/p>\n

Problemet beror p\u00e5 att antivirusprogrammet Bitdefender utf\u00f6r lokal avlyssning av HTTPS-trafik genom att ers\u00e4tta det ursprungliga TLS-certifikatet f\u00f6r webbplatsen. En extra rotcertifikat installeras p\u00e5 klientens system, vilket g\u00f6r det m\u00f6jligt att d\u00f6lja arbetet med det inspektionssystem som anv\u00e4nds. Antivirusprogrammet inf\u00f6rlivar sig i den skyddade trafiken och infogar sin egen JavaScript-kod p\u00e5 vissa sidor f\u00f6r att implementera funktionen Safe Search, och om det uppst\u00e5r problem med certifikatet f\u00f6r den skyddade anslutningen ers\u00e4tter det den visade fel sidan med sin egen. Eftersom den nya fel sidan visas i namn av den \u00f6ppnade servern har andra sidor p\u00e5 denna server full tillg\u00e5ng till inneh\u00e5llet som Bitdefender infogar.<\/p>\n

N\u00e4r en webbplats som kontrolleras av en angripare \u00f6ppnas kan denna webbplats skicka en XMLHttpRequest-f\u00f6rfr\u00e5gan och simulera ett HTTPS-certifikatproblem som resulterar i att en felmeddelandesida, manipulerad av Bitdefender, visas. Eftersom felmeddelandesidan \u00f6ppnas i angriparens dom\u00e4nkontext kan den l\u00e4sa inneh\u00e5llet p\u00e5 den manipulerade sidan med Bitdefender-parametrar. Den manipulerade Bitdefender-sidan inneh\u00e5ller bland annat en sessionsnyckel som g\u00f6r att man genom Bitdefenders interna API kan starta en separat Safepay-webbl\u00e4sarsession och ange valfria kommandoradsflaggor, vilket m\u00f6jligg\u00f6r k\u00f6rning av godtyckliga systemkommandon med hj\u00e4lp av flaggan \u2014utility-cmd-prefix. Exempel p\u00e5 ett exploit (param1 och param2 \u00e4r v\u00e4rden som erh\u00e5llits fr\u00e5n felmeddelandesidan):<\/p>\n

var request = new XMLHttpRequest();
\n request.open('POST', Math.random());
\n request.setRequestHeader('Content-type', 'application\/x-www-form-urlencoded');
\n request.setRequestHeader('BDNDSS_B67EA559F21B487F861FDA8A44F01C50', param1);
\n request.setRequestHeader('BDNDCA_BBACF84D61A04F9AA66019A14B035478', param2);
\n request.setRequestHeader('BDNDWB_5056E556833D49C1AF4085CB254FC242', 'obk.run');
\n request.setRequestHeader('BDNDOK_4E961A95B7B44CBCA1907D3D3643370D', location.href);
\n request.send('data:text\/html,nada \u2014utility-cmd-prefix=\\cmd.exe \/k whoami & echo\\');<\/p>\n

\"S\u00e5rbarhet<\/a><\/noindex><\/center><\/p>\n

Vi p\u00e5minner om att unders\u00f6kningen som genomf\u00f6rdes 2017 visade<\/a><\/noindex>, att 24 av 26 testade antivirusprodukter, som inspekterar HTTPS-trafik genom certifikatmanipulation, s\u00e4nkte den \u00f6vergripande s\u00e4kerhetsniv\u00e5n f\u00f6r HTTPS-anslutningen.
\nDe aktuella krypteringssatserna erbj\u00f6ds endast i 11 av 26 produkter. 5 system genomf\u00f6rde ingen certifikatverifiering (Kaspersky Internet Security 16 Mac, NOD32 AV 9, CYBERsitter, Net Nanny 7 Win, Net Nanny 7 Mac). Produkterna Kaspersky Internet Security och Total Security var s\u00e5rbara f\u00f6r attacker CRIME<\/a><\/noindex>, medan produkterna AVG, Bitdefender och Bullguard ocks\u00e5 utsattes f\u00f6r attacker Logjam<\/a><\/noindex> och POODLE<\/a><\/noindex>. Produkten Dr.Web Antivirus 11 till\u00e5ter att man g\u00e5r tillbaka till os\u00e4kra exportkrypteringar (attack FREAK<\/a><\/noindex>).<\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u043b\u0430\u0434\u0438\u043c\u0438\u0440 \u041f\u0430\u043b\u0430\u043d\u0442, \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c Adblock Plus, \u0432\u044b\u044f\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2020-8102) \u0432 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043d\u0430 \u0434\u0432\u0438\u0436\u043a\u0435 Chromium \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c web-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Safepay, \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u043c\u043e\u043c \u0432 \u0441\u043e\u0441\u0442\u0430\u0432\u0435 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 Bitdefender Total Security 2020 \u0438 \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u043e\u043c \u043d\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0431\u043e\u0442\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432 \u0433\u043b\u043e\u0431\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u0430\u044f \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u044f \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0438 \u043a \u0431\u0430\u043d\u043a\u0430\u043c \u0438 \u043f\u043b\u0430\u0442\u0451\u0436\u043d\u044b\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u043c). \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u0430\u0451\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0435\u043c\u044b\u043c \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 \u0441\u0430\u0439\u0442\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":86357,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-86356","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i den skyddade webbl\u00e4saren Bitdefender SafePay som leder till kodexekvering | ProHoster","description":"Vladimir Palant, skaparen av Adblock Plus, identifierade","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u043c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0435 Bitdefender SafePay, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 | ProHoster","og:description":"\u0412\u043b\u0430\u0434\u0438\u043c\u0438\u0440 \u041f\u0430\u043b\u0430\u043d\u0442, \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u044c Adblock Plus, \u0432\u044b\u044f\u0432\u0438\u043b","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-zashhishhyonnom-brauzere-bitdefender-safepay-privodyashhaya-k-vypolneniyu-koda","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-06-24T11:42:00+00:00","article:modified_time":"2020-06-24T11:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"86356","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 14:17:32","updated":"2022-09-28 12:42:50","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/86356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=86356"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/86356\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media\/86357"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=86356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=86356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=86356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}