Ukuba sengozini (CVE-2021-39341) kukhonjwe kusengezo se-OptinMonster WordPress, esinokufakwa okusebenzayo okungaphezu kwesigidi futhi sisetshenziselwa ukubonisa izaziso ezizivelelayo nokunikezwayo, okukuvumela ukuthi ubeke ikhodi yakho ye-JavaScript kusayithi. usebenzisa isengezo esicacisiwe. Ukuba sengozini kulungisiwe ekukhishweni okungu-2.6.5. Ukuze uvimbele ukufinyelela ngokhiye abathunjiwe ngemva kokufaka isibuyekezo, abathuthukisi be-OptinMonster bahoxise bonke okhiye bokufinyelela be-API abadalwe ngaphambilini futhi bangeze imikhawulo ekusetshenzisweni kokhiye besayithi le-WordPress ukuze balungise imikhankaso ye-OptinMonster.
Inkinga idalwe ukuba khona kwe-REST-API /wp-json/omapp/v1/support, engafinyelelwa ngaphandle kokuqinisekisa - isicelo senziwe ngaphandle kokuhlola okwengeziwe uma ngabe inhlokweni yesiReferensi iqukethe iyunithi yezinhlamvu βhttps://wp .app.optinmonster.testβ nalapho usetha uhlobo lwesicelo se-HTTP ku-"OPTIONS" (kukhishwe unhlokweni we-HTTP othi "X-HTTP-Method-Override"). Phakathi kwedatha ebuyisiwe lapho kufinyelelwa i-REST-API okukhulunywa ngayo, bekukhona ukhiye wokufinyelela okuvumela ukuthi uthumele izicelo kunoma yiziphi izibambi ze-REST-API.
Esebenzisa ukhiye otholiwe, umhlaseli angenza izinguquko kunoma imaphi amabhulokhi azivelelayo aboniswa kusetshenziswa i-OptinMonster, okuhlanganisa ukuhlela ukusetshenziswa kwekhodi yakhe ye-JavaScript. Ngemva kokuthola ithuba lokusebenzisa ikhodi yakhe ye-JavaScript kumongo wesayithi, umhlaseli angakwazi ukuqondisa kabusha abasebenzisi kusayithi lakhe noma ahlele ukushintshwa kwe-akhawunti eyilungelo kusixhumi esibonakalayo sewebhu lapho umlawuli wesayithi asebenzise ikhodi ye-JavaScript efakwe esikhundleni. Njengoba inokufinyelela kusixhumi esibonakalayo sewebhu, umhlaseli angazuza ekusebenziseni ikhodi yakhe ye-PHP kuseva.
Source: opennet.ru