TL; DR
E whakaatu ana te axios npm compromise me pēhea te whakaekenga a te mekameka tuku taonga hou whakamahi i ngā whakawhirinakitanga pono hei uru atu ki ngā raraunga tairongo i te wā e whakahaerehia ana. Kua tātarihia tēnei kaupapa e ngā kairangahau haumarutanga maha, tae atu ki ngā wehewehenga taipitopito mai i Waehe42 te kapinga ahumahi e whakaatu ana i ngā tauira tohu e hono ana ki ngā mahi a te iwi.
Ka pā tēnei āhuatanga ki:
- Ngā tīma DevOps e whakahaere ana CI/CD pipelineme te manatoko e hangai ana ki te taiao
- Ngā ratonga papamuri e whakahaere ana i ngā tono API kua manatokohia
- Ngā tono e whakamahi ana i ngā axios mō te whakawhitiwhiti kōrero HTTP ā-roto, ā-waho hoki
Nā te mea kei roto a axios i te paparanga tono, ka taea e tētahi putanga kua takahia te uru atu ki:
- Ngā pane whakamanatanga me Tohu API
- Ngā taurangi taiao me ngā mea ngaro
- Te whakawhitiwhiti kōrero ratonga ā-roto
Ehara i te whakawhirinakitanga tonu te tino pānga, engari ko te mea ka taea e ia te uru atu ina oti te whakahaere.
Nga mahi tonu:
- Maukati i ngā putanga whakawhirinakitanga me te arotake i ngā whakahōutanga hou
- Hurihia ngā kī API, ngā tohu, me CI/CD ngā tohu mātauranga
- Aroturuki i ngā tono e puta atu ana me ngā mahi manatoko
- Arotake pipelines mō ngā mea ngaro kua whakakitea
Ngā Mea i Tupu i te Whakaekenga Axios npm
Ko te aituā axios e whai ana i tētahi tauira e tipu haere ana i roto i ngā whakaeke mekameka tuku, e aro atu ana ngā kaiwhakaeke ki ngā whakawhirinakitanga e whakamahia whānuitia ana, kaua ki ngā ngoikoretanga taupānga.
Mā te whakararu i tētahi mōkihi pono, ka whiwhi ngā kaiwhakaeke i te whakamatenga i roto i ngā mano tini taiao i te wā kotahi.
Nā te mea ko axios tētahi o ngā kiritaki HTTP e whakamahia whānuitia ana i roto i te pūnaha JavaScript, kua whakauruhia hōhonu ki roto i:
- Ngā ratonga papamuri
- Ngā tono o mua
- CI/CD pipelines
Nā tēnei he ūnga tino uara tēnei.
Kia whakaurua mai he putanga kino, kia whakahaerehia hoki, ka riro mai i a ia ngā whakaaetanga ōrite ki te taupānga nāna i kawemai. Kei roto i tēnā ko te urunga ki te hokohoko whatunga, ngā tohu tuakiri, me ngā ratonga ā-roto.
I aro nui atu hoki te hunga i roto i te hapori haumarutanga ki tēnei mahi taupatupatu, me ngā pūrongo pēnei i a Axios. kapinga
e tohu ana ki ngā hononga pea ki ngā kaiwhakaari mōrearea matatau me ngā pakanga kua whakaritea.
Ngā Mahi Tuturu a te Axios Attack i te Wā Whakahaere
Ko te mea nui ki te mārama ki tēnei whakaeke ko te arotahi ki ngā whanonga wā-oma.
Ka mahi a Axios i te paparanga HTTP, arā, ka whakahaere i ngā tono tuku atu. Mā tēnei ka kitea tika ngā raraunga tairongo e rere ana i roto i te taupānga.
Ka taea e tētahi putanga kua takahia te:
- Āraihia ngā tono e tukuna atu ana i mua i te tukunga atu
- hopu
Authorizationngā pane me ngā tohu API - Whakauru atu ki ngā taurangi taiao mā
process.env - Mātakitaki i ngā whakawhitiwhiti kōrero i waenga i ngā ratonga ā-roto
Hei tauira, ka taea e tētahi kaiwawao kino te tango i ngā pane motuhēhēnga me te tuku puku atu ki tētahi pūwāhi o waho.
I taua wā anō, mā te urunga atu ki ngā taurangi taiao ka taea e ngā kaiwhakaeke te tiki i ngā tohu tuakiri me te kore e whakarerekē i te arorau tono.
Mai i waho, kei te haere tonu ngā mea katoa e ai ki te tumanako. Ka oti pai ngā tono, ka whakautu noa ngā ratonga, ā, pipelineKāore he tohu o te korenga o ngā mahi. I taua wā anō, tera pea kua kitea kētia ngā raraunga tairongo mā roto i ngā ara whakahaere papamuri.
Rere Whakaeke Axios: Mai i te Mōkihi Whakararuraru ki te Whakaaturanga Huna
1. Whakatau
Ka whiwhi te kaiwhakaeke i te mana whakahaere i tētahi pūkete kaitiaki pono, i tētahi ara tuku mōkihi rānei i roto i te pūnaha axios.
2. Tohatoha
Ka whakaputaina ngā putanga kino ki te npm ka kumea ki ngā mīhini kaiwhakawhanake, CI/CD pipelines, ā, ka hangaia te taupānga mā roto i ngā whakahōutanga whakawhirinakitanga noa.
3. Te Whakahaere Wā-Oma
Ka whakahaerehia te kawenga ina kawemaihia, ina whakamahia hoki a axios, ka riro mai i a ia ngā mana whakahaere rite tonu ki te tono.
4. Te Urunga Huna
Ka kitea ngā pane, ngā tohu, ngā taurangi taiao, me ngā whakawhitiwhitinga HTTP ā-roto o te whakawhirinakitanga kua taupatupatuhia.
5. Te Tātaritanga
Ka tukuna pukutia ngā raraunga tairongo ki ngā hanganga e whakahaerehia ana e te kaiwhakaeke, i te mea ka mahi tonu ngā tono taketake i te āhua noa.
Ngā Tohu o te Whakaaetanga (IoC)
Hei tirotiro i te tūponotanga o te pānga, me tīmata ngā tīma mā te arotake i ngā tohu e mōhiotia ana e pā ana ki te axios compromise. Kei te ripanga i raro nei ngā tohu tino whaitake puta noa i ngā mōkihi, ngā mahi whatunga, me ngā taonga manaaki.
Me pēhea te whakamārama i ēnei IoC
Ahakoa he whai hua ēnei tohu, kaua e kiia he rautaki kimi katoa.
I roto i te mahi, he onge te whakawhirinaki o ngā whakaeke pēnei ki tētahi tohu tūmau kotahi. Ka huri ngā rohe, ka whanake ngā kawenga, ā, ka tere te tawhito o ngā hash. Ko te mea e mau tonu ana ko te whanonga.
Hei tauira, ko ngā tono putanga ohorere i te wā o te whakahaerenga HTTP noa ka tohu pea i te tango raraunga. Waihoki, ko te whakamahinga o ngā tohu whaimana i roto i ngā horopaki rerekē he tohu pea kua hurahia kētia ngā mea ngaro.
I te taumata kaihautū, ko te noho mai o ngā hōtuhi rangitahi, ngā pūnaha rua rānei, ka tohu pea i ngā mahi whai muri i te whakamahinga, inā koa ka honoa ki ngā āhuatanga rerekē o te whatunga.
Ara, ka āwhina ngā IoC i a koe ki te whakaū i tētahi aituā.
Heoi, mā te mārama ki ngā whanonga ka taea e koe te kite wawe i te whanonga.
| kāwai | tohu | taipitopito |
|---|---|---|
| mōkī | axios@1.14.1 | shasum: 2553649f2322049666871cea80a5d0d6adc700ca |
| mōkī | axios@0.30.4 | shasum: d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 |
| whakawhirinaki | plain-crypto-js@4.2.1 | shasum: 07d889e2dadce6f3910dcbc253317d28ca61c766 |
| whatunga | sfrclak[.]com | Rohe whakahau-me-te-mana |
| whatunga | 142.11.206[.]73 | IP hanganga e pā ana |
| whatunga | http://sfrclak[.]com:8000/6202033 | Te pito mutunga o te tātaritanga i kitea |
| MacOS | /Library/Caches/com.apple.act.mond | SHA256: 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a |
| Windows | %PROGRAMDATA%\wt.exe | Taonga pumau pea |
| Windows | %TEMP%\6202033.vbs | He taonga whakahaere e hangai ana ki te tuhinga |
| Windows | %TEMP%\6202033.ps1 | Utauta PowerShell. SHA256: 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 |
| Linux | /tmp/ld.py | SHA256: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf |
Tuhipoka tirotirohanga: He tīmatanga whai hua ēnei IoC mō te rapu tūraru. Heoi, ka taea e ngā kaiwhakaeke te huri tere i ngā rohe, ngā kawenga, me ngā taonga. Mō tēnā take, me hono e ngā tīma ēnei tohu ki ngā tohu whanonga pēnei i te waka HTTP puta ohorere, te urunga rerekē ki process.env, me ngā whakahōutanga whakawhirinakitanga rerekē.
Tauira: Me pēhea te tango raraunga i roto i te Axios npm kua taupatupatuhia
Hei mārama ki te mahi a tēnei whakaeke Axios npm i roto i te mahi, whakaarohia tētahi tauira māmā.
Mā Axios ka taea e ngā kaiwhakawhanake te tautuhi i ngā kaiwawao tono. Ka whakahaerehia aunoatia ēnei kaiwawao i mua i ia tono HTTP.
Ka taea e tētahi putanga kino o axios te whakamahi kino i tēnei tikanga:
He aha te take he mōrearea te whakaekenga npm a Axios
I te tirohanga tuatahi, kāore he mea e hē ana. Kua oti pai te tono, kua rite te mahi a te tono ki tā te mea i tumanakohia, ā, pipelineka haere tonu te haere me te kore he hapa.
Heoi, ko te taipitopito nui ka puta i mua i te tukunga o te tono. I roto i taua matapihi whakatinanatanga, ka taea e te whakawhirinakitanga kua taupatupatu te uru atu me te kohikohi i ngā raraunga tairongo pēnei i ngā pane whakamanatanga, ngā tohu API, ngā raraunga tono, me ngā taurangi taiao.
Nā te mea ka oma tēnei arorau i roto i tētahi whare pukapuka pono e tū tika ana i te ara tono HTTP, ka mahi tahi me ngā mana ōrite ki te taupānga tonu. Nō reira, ka taea e ia te uru atu ki ngā raraunga e tiakina ana i ngā kaiwhakaeke o waho.
Ehara i te mea ko te urunga raraunga anake te mea e tino mōrearea ai tēnei, engari ko te kore o te pānga e kitea ana. Kāore he whakararuraru i te mahi, kāore he tono i rahua, ā, kāore he tohu tonu kei te hē tetahi mea. Mai i te tirohanga whakahaere, kei te haere tonu ngā mea katoa e ai ki te tumanako.
I taua wā tonu, tera pea kei te wehe atu ngā mōhiohio tairongo i te pūnaha mā roto i ngā hononga ki waho e hanumi ana ki ngā rerenga tono noa.
He aha tēnei he raruraru DevOps i te tuatahi
Mō ngā tīma DevOps, he tino uaua ki te kite i tēnei momo whakaeke nā te mea ka hono pai ki ngā rerengamahi o nāianei.
Ka tāuta aunoa ngā whakawhirinakitanga, pipelineKa whakahaerehia te mahi i runga i te tikanga noa, ā, kāore he hapa e puta tonu mai.
I te wa ano, CI/CD He maha ngā taiao e whakaatu ana i ngā tohu mātauranga tino nui, tae atu ki:
- Ngā tohu kaiwhakarato kapua
- Ngā kī whakatinanatanga
- CI/CD ngā mea ngaro motuhēhē
Ka taea e tētahi whakawhirinakitanga kua taupatupatu te uru tika atu ki aua tohu tuakiri.
Ka puta he āhuatanga e āhua noa ana ngā mea katoa, engari kei te uru atu ngā raraunga tairongo ki muri.
Te Tūponotanga Tuturu: Te Whakapuakanga Ngaro i te Tauine
E whakaatu ana te Axios NPM Compromise i tētahi panonitanga nui i roto i ngā rautaki whakaeke hou.
Ehara i te mea ko te whakamahi i ngā ngoikoretanga te whāinga, engari ko te uru atu ki ngā tohu whaimana.
Nā te mea e whakawhirinaki ana ngā pūnaha hou ki te manatoko e ahu mai ana i te taiao, ka taea e te whakawhirinakitanga e rere ana i te wā whakahaere te uru atu ki:
- Taviri API
- Ngā tohu ratonga
- Ngā tohu kapua
Kāore e hiahiatia kia takahia ēnei tohu whakamana.
Me whakamahi noa iho rātou.
Mā tēnei ka taea e ngā kaiwhakaeke te neke taha, te uru atu ki ngā ratonga, me te tango raraunga mā te whakamahi i te manatoko tika.
Nā reira, ko te pānga e whakawhirinaki ana ki ngā mea ngaro e huraina ana, ehara i te āhua o te whakatinanatanga o te whakaeke.
He aha i ngaro ai tēnei i ngā taputapu haumarutanga tuku iho
He uaua ki ngā huarahi tuku iho te kite i ēnei whakaeke nā te mea e aro ana ki ngā ngoikoretanga e mōhiotia ana, ki ngā tohu tūmau rānei. Heoi, e ai ki te whakamārama i roto i Te tātaritanga a OpenAI Mō te takahi i te taputapu kaiwhakawhanake a Axios, ka puta te mōrearea tūturu i te wā whakahaere, ina taunekeneke ngā whakawhirinakitanga pono me ngā raraunga tairongo.
Heoi, kāore pea he tohu mārama e kitea ana i roto i tētahi whakawhirinakitanga kua taupatupatu.
Tera pea:
- Kāore he CVE
- Kāore he waitohu kino
- Kāore he wetereo rerekē
I taua wā anō, kāore te tātaritanga tūmau e aromatawai i te whanonga wā-oma. Kāore e taea te whakatau me pēhea te taunekeneke a te whakawhirinakitanga ki ngā raraunga tairongo ina oti te whakahaere.
Ka puta he āputa i te wā e āhua haumaru ai te waehere i te wā tātari engari ka noho mōrearea i te wā e whakatinanahia ana.
Me pēhea te kimi me te ārai i ngā whakaekenga rite ki te npm a Axios
Hei ārai i tēnei momo whakaekenga npm a Axios me neke atu i te tirotiro tūmau ki te mōhiotanga wā-oma.
Me mārama ngā tīma ki te whanonga o ngā whakawhirinakitanga, kaua ko ngā mea anake kei roto.
Kei roto i tenei ko:
- Te aroturuki i te urunga atu ki ngā raraunga tairongo i te wā e whakahaerehia ana
- Te kimi i ngā mea ngaro i mua i te taenga atu ki ngā putunga
- Matawai pipelinengā taonga tuku iho mō ngā tohu tuakiri kua whakakitea
- Te tirotiro i ngā mahi whatunga puta atu mō ngā hapa
Heoi, kāore e ranea te kimi noa iho.
Mai i te Kimi ki te Ārai: He aha te Mea e Whakaiti ana i te Mōrearea
Whai muri i tētahi aituā pēnei, he maha ngā wā ka tūtaki ngā tīma ki te maha o ngā tohu tuakiri ka huraina pea.
Ehara i te kimi i a rātou te wero, engari ko te tautuhi ko ēhea ngā mea nui.
Ko te pātai matua ka pēnei:
Ko ēhea ngā mea ngaro e whai mana tonu ana, e taea tonu ana te whakamahi?
Ki te kore he manatoko, ka pau te wā o ngā tīma ki ngā tohu tuakiri kore mahi, engari kei te tūwhera tonu ngā mōrearea tūturu.
Ko te urupare whai hua e hiahiatia ana:
- Te kimi i ngā mea ngaro kua whakakitea
- Te manatoko mēnā kei te whakaae tonu rātou ki te urunga
- Te whakakore, te huri rānei i a rātou i te wā tere
Ka whakaitihia te wā whakaaturanga, ka whakawhāitihia hoki te matapihi o te kaiwhakaeke.
Te Āwhina a Xygeni ki te Whakaiti i te Mōrearea o te Mekameka Tuku
Xygeni e aro ana ki tēnei wero mā te whakakotahi i te kimi, te manatoko, me te whakatika ki roto i te tukanga mahi kotahi.
Ka tautuhi tonu i ngā mea ngaro kua hurahia puta noa i te waehere, pipelines, me ngā taonga tuku iho. I taua wā anō, ka whakamanahia mēnā kei te kaha tonu aua tohu i roto i te taiao.
Mā tēnei ka taea e ngā tīma te arotahi ki ngā mea ka taea e ngā kaiwhakaeke te whakamahi.
Kia tautuhia ngā mea ngaro hohe, ka āwhina ngā rerengamahi whakaora aunoa ki te whakaiti i te wā whakaaturanga mā te whakakorenga, te hurihanga whakahaere rānei.
Nā reira, ka tere ake te urupare, ka nui ake te arocise, ā, he iti ake te whakararuraru.
Opaniraa
Ko te axios npm compromise e whakaata ana i te whanaketanga o ngā whakaeke mekameka tuku.
Kāore e hiahiatia ana e ngā kaiwhakaeke te pakaru i ngā pūnaha. Ka whakawhirinaki rātou ki ngā whakawhirinakitanga pono hei uru atu ki ngā raraunga tairongo i te wā e whakahaerehia ana.
Mō ngā tīma DevOps, ko te tikanga o tēnei ko te mārama ki ngā whanonga wā-oma. Mō ngā kaiārahi haumarutanga, ko te tikanga o tēnei ko te whakaiti tere me te whai hua i te pānga.
Nā te mea i ngā taiao o ēnei rā, ehara te mea nui rawa i te mea ka whakatinanahia.
Koinei te mea ka uru atu ina rere.
