ืคึผืจืึธื”ืึธืกื˜ืขืจ > ื‘ืœืึธื’ > ืื™ื ื˜ืขืจื ืขื˜ ื ื™ื™ึทืขืก > ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ืŸ ื“ื™ PharStreamWrapper ื‘ื™ื‘ืœื™ืึธื˜ืขืง ื•ื•ืึธืก ื•ื•ื™ืจืงืŸ ื“ืจื•ืคึผืึทืœ, ื“ื–ืฉืึธืึธืžืœืึท ืื•ืŸ ื˜ื™ืคึผืึธ3

ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ืŸ ื“ื™ PharStreamWrapper ื‘ื™ื‘ืœื™ืึธื˜ืขืง ื•ื•ืึธืก ื•ื•ื™ืจืงืŸ ื“ืจื•ืคึผืึทืœ, ื“ื–ืฉืึธืึธืžืœืึท ืื•ืŸ ื˜ื™ืคึผืึธ3

ืื™ืŸ ื‘ื™ื‘ืœื™ืึธื˜ืขืง PharStreamWrapper, ื•ื•ืึธืก ื’ื™ื˜ ื”ืึทื ื“ืœืขืจืก ืฆื• ื‘ืึทืฉื™ืฆืŸ ืงืขื’ืŸ ื”ืืœื˜ืŸ ืื ืคืืœืŸ ื“ื•ืจืš ื˜ืขืงืข ืกืึทื‘ืกื˜ื™ื˜ื•ืฉืึทืŸ ืื™ืŸ ื“ื™ "Phar" ืคึฟืึธืจืžืึทื˜, ื™ื™ื“ืขื ืึทืคื™ื™ื“ ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ (CVE-2019-11831), ื•ื•ืึธืก ืึทืœืึทื•ื– ืื™ืจ ืฆื• ื‘ื™ื™ืคึผืึทืก ืงืึธื“ ื“ืขืกืขืจื™ืึทืœื™ื–ื™ื™ืฉืึทืŸ ืฉื•ืฅ ื“ื•ืจืš ืกืึทื‘ืกื˜ื™ื˜ื•ื˜ื™ื ื’ ".." ืื•ืชื™ื•ืช ืื™ืŸ ื“ืขื ื“ืจืš. ืคึฟืึทืจ ื‘ื™ื™ึทืฉืคึผื™ืœ, ืึท ืึทื˜ืึทืงืขืจ ืงืขื ืขืŸ ื ื•ืฆืŸ ืึท URL ื•ื•ื™ "phar:///path/bad.phar/../good.phar" ืคึฟืึทืจ ืึท ื‘ืึทืคืึทืœืŸ, ืื•ืŸ ื“ื™ ื‘ื™ื‘ืœื™ืึธื˜ืขืง ื•ื•ืขื˜ ื”ื•ื™ื›ืคึผื•ื ืงื˜ ื“ื™ ื‘ืึทื–ืข ื ืึธืžืขืŸ "/path/good.phar" ื•ื•ืขืŸ ืงืึธื ื˜ืจืึธืœื™ืจื•ื ื’, ื›ืึธื˜ืฉ ื‘ืขืฉืึทืก ื•ื•ื™ื™ึทื˜ืขืจ ืคึผืจืึทืกืขืกื™ื ื’ ืคื•ืŸ ืึทื–ืึท ืึท ื“ืจืš ื“ื™ ื˜ืขืงืข "/path/bad.phar" ื•ื•ืขื˜ ื–ื™ื™ืŸ ื’ืขื•ื•ื™ื™ื ื˜.

ื“ื™ ื‘ื™ื‘ืœื™ืึธื˜ืขืง ืื™ื– ื“ืขื•ื•ืขืœืึธืคึผืขื“ ื“ื•ืจืš ื“ื™ ืงืจื™ื™ื™ื˜ืขืจื– ืคื•ืŸ ื“ื™ CMS TYPO3, ืึธื‘ืขืจ ืื™ื– ืื•ื™ืš ื’ืขื ื™ืฆื˜ ืื™ืŸ ื“ืจื•ืคึผืึทืœ ืื•ืŸ ื“ื–ืฉืึธืึธืžืœืึท ืคึผืจืึทื“ื–ืฉืขืงืก, ื•ื•ืึธืก ืžืื›ื˜ ื–ื™ื™ ืื•ื™ืš ืกืึทืกืขืคึผื˜ืึทื‘ืึทืœ ืฆื• ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ื–. ืึทืจื•ื™ืกื’ืขื‘ืŸ ืคืึทืจืคืขืกื˜ื™ืงื˜ ืื™ืŸ ืจื™ืœื™ืกื™ื– PharStreamWrapper 2.1.1 ืื•ืŸ 3.1.1. ื“ื™ ื“ืจื•ืคึผืึทืœ ืคึผืจื•ื™ืขืงื˜ ืคืึทืจืคืขืกื˜ื™ืงื˜ ื“ืขื ืึทืจื•ื™ืกื’ืขื‘ืŸ ืื™ืŸ ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงื•ื ื’ืขืŸ 7.67, 8.6.16 ืื•ืŸ 8.7.1. ืื™ืŸ ื“ื–ืฉืึธืึธืžืœืึท ื“ื™ ืคึผืจืึธื‘ืœืขื ืื™ื– ืืจื•ื™ืก ื–ื™ื ื˜ ื•ื•ืขืจืกื™ืข 3.9.3 ืื•ืŸ ืื™ื– ื’ืขื•ื•ืขืŸ ืคืึทืจืคืขืกื˜ื™ืงื˜ ืื™ืŸ ืžืขืœื“ื•ื ื’ 3.9.6. ืฆื• ืคืึทืจืจื™ื›ื˜ืŸ ื“ืขื ืคึผืจืึธื‘ืœืขื ืื™ืŸ TYPO3, ืื™ืจ ื“ืึทืจืคึฟืŸ ืฆื• ื“ืขืจื”ื™ื™ึทื ื˜ื™ืงืŸ ื“ื™ PharStreamWapper ื‘ื™ื‘ืœื™ืึธื˜ืขืง.

ืื•ื™ืฃ ื“ื™ ืคึผืจืึทืงื˜ื™ืฉ ื–ื™ื™ึทื˜, ืึท ื•ื•ืึทืœื ืขืจืึทื‘ื™ืœื™ื˜ื™ ืื™ืŸ PharStreamWapper ืึทืœืึทื•ื– ืึท ื“ืจื•ืคึผืึทืœ ืงืึธืจ ื‘ืึทื ื™ืฆืขืจ ืžื™ื˜ 'ืึทื“ืžื™ื ื™ืกื˜ืจื™ืจืŸ ื˜ืขืžืข' ืคึผืขืจืžื™ืฉืึทื ื– ืฆื• ืฆื•ืคึฟืขืœื™ืงืขืจ ืึท ื‘ื™ื™ื–ืข ืคืึทืจ ื˜ืขืงืข ืื•ืŸ ืคืึทืจืฉืึทืคืŸ ื“ื™ PHP ืงืึธื“ ืงืึทื ื˜ื™ื™ื ื“ ืื™ืŸ ืขืก ืฆื• ื–ื™ื™ืŸ ืขืงืกืึทืงื™ื•ื˜ืึทื“ ืื•ื ื˜ืขืจ ื“ื™ ื’ื™ื™ื– ืคื•ืŸ ืึท ืœืึทื“ื–ืฉื™ื˜ืึทืžืึทื˜ ืคืึทืจ ืึทืจืงื™ื™ื•ื•. ืฆื•ืจื™ืงืจื•ืคืŸ ืึทื– ื“ื™ ืขืกืึทื ืก ืคื•ืŸ ื“ื™ "ืคืึทืจ ื“ื™ืกืขืจื™ืึทืœื™ื–ืึทื˜ื™ืึธืŸ" ื‘ืึทืคืึทืœืŸ ืื™ื– ืึทื– ื•ื•ืขืŸ ืงืึธื ื˜ืจืึธืœื™ืจื•ื ื’ ื“ื™ ืœืึธื•ื“ื™ื“ ื”ื™ืœืฃ ื˜ืขืงืขืก ืคื•ืŸ ื“ื™ PHP ืคื•ื ืงืฆื™ืข file_exists(), ื“ื™ ืคึฟื•ื ืงืฆื™ืข ืื•ื™ื˜ืึธืžืึทื˜ื™ืฉ ื“ืขืกืขืจื™ืึทืœื™ื–ืขืก ืžืขื˜ืึทื“ืึทื˜ืึท ืคื•ืŸ ืคืึทืจ ื˜ืขืงืขืก (PHP ืึทืจื˜ืฉื™ื•ื•ืข) ื•ื•ืขืŸ ืคึผืจืึทืกืขืกื™ื ื’ ืคึผืึทื˜ืก ืกื˜ืึทืจื˜ื™ื ื’ ืžื™ื˜ "phar: //" . ืขืก ืื™ื– ืžืขื’ืœืขืš ืฆื• ืึทืจื™ื‘ืขืจืคื™ืจืŸ ืึท PHAR ื˜ืขืงืข ื•ื•ื™ ืึท ื‘ื™ืœื“, ื•ื•ื™ื™ึทืœ ื“ื™ file_exists () ืคึฟื•ื ืงืฆื™ืข ื“ื™ื˜ืขืจืžืึทื ื– ื“ื™ MIME ื˜ื™ืคึผ ื“ื•ืจืš ืื™ื ื”ืึทืœื˜, ืื•ืŸ ื ื™ืฉื˜ ื“ื•ืจืš ืคืึทืจืœืขื ื’ืขืจื•ื ื’.

ืžืงื•ืจ: opennet.ru

ืœื™ื™ื’ืŸ ืึท ื‘ืึทืžืขืจืงื•ื ื’