laravel 11.30.0 exploit - laravel exploit - ngā ngoikoretanga o laravel 11.30.0

Laravel 11.30.0 Exploit: Ngā Mea Me Whakatikatika e Ngā Kaiwhakawhanake Inaianei

Te pikinga ake o ngā ngoikoretanga o Laravel 11.30.0 i roto i ngā taupānga kua whirihorahia hē

 Ehara i te mea he hapa iti noa te whakamahinga o Laravel 11.30.0, engari ka taea e ia te arahi ki te whakararuraru katoa i te taupānga ina honoa ki ngā whirihoranga hē noa. Ko te take matua kei roto i te huarahi ka taea te karo i te whakamana tukuake kōnae, e āhei ai ngā kaiwhakaeke ki te tukuake i ngā kōnae haumaru ahakoa ngā ture e kitea ana.

Anei ngā tauira whai hua o ngā whirihoranga hē morearea:

  • ⚠️ APP_DEBUG=pono in Tuhinga .env
    Mā tēnei tautuhinga ka whakaatuhia ngā tohu puranga katoa me ngā mōhiohio patuiro tairongo. Mēnā ka waiho kia hohe i waho o te whanaketanga ā-rohe, ka taea e ngā kaiwhakaeke te kite i ngā ara, ngā okotahi, ngā akomanga, me ētahi atu.

  • ⚠️ He ngoikore, he kore rānei e hurihia KĪ_APP
    He poto, he matapaetia, he kore rānei e hurihia KĪ_APP ka taea e ngā kaiwhakaeke te wetewete i ngā wātū, te hanga rānei i ngā tohu kua hainatia.

⚠️ Ngā ara kāore he pūmanawa waenga motuhēhēnga

 Route::post('/upload', [UploadController::class, 'store']);  

Kāore he pūmanawa waenga pērā i auth or whakaū, e wātea ana tēnei ara ki te marea, he huarahi ngāwari hoki mō ngā mahi tinihanga. Ina kitea ēnei whirihoranga ngoikore, ka nui haere te mōrearea o ngā ngoikoretanga o Laravel 11.30.0. Mēnā kei te whakamahi koe i te 11.30.0, he āhuatanga nui tēnei me whakatika.

Ngā Tauira Whakamahi a Laravel i roto i te Waehere: Ngā Kaiwhakahaere, Ngā Pūmanawa Waenga me Ngā Ara

Kāore ngā kaiwhakaeke e aro noa ki ngā mahi ā-roto o te anga; ka whakamahia hoki e rātou ngā hapa a te kaiwhakawhanake. Ka taea te hono atu ki te whakamahinga Laravel i roto i te 11.30.0 me ngā take taumata-waehere noa:

Tauira Mōrearea: Ngaro te Parenga Waenga

Route::post('/upload', [UploadController::class, 'store']); 

⚠️ Kāore he mana whakamana, he pūmanawa waenga rānei kua manatokohia, ka taea e te tangata katoa te uru atu ki tēnei pūwāhi.

Whakamana Kōnae Kore Haumaru

$request->validate([ 'file' => 'required|file|mimes:jpg,png,pdf' ]);  

⚠️ I roto i te Laravel 11.30.0, ka taea te karo i tēnei whakamana, ka taea ai te uru atu o ngā kōnae tūpono.

 Ngā Mea i Whakarērea e te Kaiwhakahaere

if ($request->file('file')->isValid()) { // Save file } 

Ki te kore e whakamanahia te momo kōnae taha-tūmau, ka taea e ngā kaiwhakaeke te whakamahi i te whakamahinga Laravel 11.30.0 hei penapena i ngā kōnae kāore e hiahiatia. Ki te honoa ki te pūmanawa waenga me te ara kore haumaru, ka huri tēnei hei mekameka whakamahi katoa.

Ngā Whakawhirinakitanga ki ngā Kaiwaiata me te Mōrearea Huna i roto i ngā Mōkihi Pūtake Tuwhera

koutou kaitito.json a kaitito.raka Tērā pea kei te whakahohe puku ngā kōnae i te mahi kino. He maha ngā tīma whakawhanake e whakatuwhera ana i te kuaha ki ngā ngoikoretanga mā te kore e mōhiotia:

  • Te kore e whakapiri pūmau i ngā putanga Laravel (hei tauira, mā te whakamahi i ^ 11.0 hei utu mō tētahi putanga papaki kua whakaritea)
  • Te peke i ngā arotake haumarutanga aunoa i roto i CI/CD
  • Tae atu ki ngā mōkihi tuatoru kua tawhito, kāore rānei i te pai te tiaki

Anei me titiro maau:

⚠️ Ngā Herenga Wetekina i roto i kaitito.json

"require": {   "laravel/framework": "^11.0",   "some/package": "*" } 

Mā ēnei ka taea te tāuta puku i ngā putanga ngoikore (pēnei i te 11.30.0) i ngā tāutanga hou, i ngā whakahōutanga rānei.

✅ Mārama kaitito.raka Tirohia

Whakatūwhera koe kaitito.raka kōnae me te manatoko:

  • Ko te putanga Laravel > = 11.30.1, kei roto ko te papaki haumarutanga
  • Kāore ngā mōkihi tuatoru e kukume i ngā putanga ngoikore tawhito mā roto i ngā whakawhirinakitanga whakawhiti
  • Whakamahia nga taputapu penei: arotake kaitito

Me ngā whakaurunga CI (hei tauira, Nga Mahi a GitHub, GitLab CI) hei tohu aunoa i ngā mōkihi kore haumaru me ngā putanga tawhito.

CI/CDRārangi Arowhai Whakatakoto-Mua hei Whakamutu i te Whakamahinga a Laravel 11.30.0

DevSecOps kāore e taea te whakawhirinaki ki ngā whakatikatika i muri i te whakatinanatanga. Hei aukati i te whakamahinga a Laravel 11.30.0 i mua i tōna taenga ki te whakaputa, ko tāu pipeline me whai mana tirotiro haumarutanga.

⚠️ Ngā Mana Whakatakoto-Mua e Ngaro Ana = Te Mōrearea Nui

Tenei ko te rārangi arowhai poto koutou CI/CD me whakamana te tukanga i mua i ia whakatinanatanga:

  • whakarite APP_DEBUG kua monokia i roto i ngā taiao kāore i te whakawhanakehia
    Whirihora hē Tuhinga .env Ko ngā kōnae e turuturu ana i ngā mōhiohio patuiro he ara whakaeke tika.
  • Hurihia, whakamanahia hoki te kaha o KĪ_APP
    Ka raru ngā raraunga whakamunatia pēnei i ngā wātū me ngā tohu i tētahi kī ngoikore, tawhito rānei.
  • Arotake kaitito.raka me ngā whakawhirinakitanga o waho
    Whakahaere arotake kaitito ki te kimi i ngā whare pukapuka ngoikore, me te manatoko kei te wātea te putanga Laravel > = 11.30.1.
  • Matawaihia ngā ara mō ngā pūwāhi mutunga kāore i tiakina
    Me whakarite kia tiakina ngā ara tairongo katoa (hei tauira, ngā tukuake, ngā papatohu whakahaere) e te pūmanawa whakamotuhēhēnga.
  • Whakamanahia te putanga anga Laravel i roto i te CI
    Ngā hanganga poraka e tāuta ana anga/raravel ngā putanga iti iho i 11.30.1.

Ehara ēnei arowhai i te mea he mahi pai noa iho; ko tō rārangi mua hoki ēnei hei ārai i tēnei me ngā mahi a Laravel ā muri ake nei.

Kaua e tāpiri noa, engari me whai i te mōrearea ki a Xygeni

Mā te whakatikatika ka tangohia te mōrearea tonu, engari me pēhea ngā ara waehere tawhito me te hanga taonga kei roto tonu te hapa? Xygeni āwhina ki te whai:

  • Ngā hanganga o mua i whakaurua ai ngā ngoikoretanga o Laravel 11.30.0
  • Ngā whakamāramatanga ara haumaru kore, ngā herenga kaiwhakahaere rānei
  • Ngā mekameka whakauru kāore i whakamanahia i roto i ngā ara
  • Ngā taurangi taiao kore haumaru i roto i ngā whakatinanatanga tawhito

Ki a Xygeni, kāore koe e aukati noa i te mahi a Laravel e whai ake nei; ka aroturukihia e koe te wāhi kua tau kē.

Whakapai ake i a Laravel 11.30.1, ā, Maukati i tō Taupānga

Mena kei te whakahaere tō taupānga i te Laravel 11.30.0, whakaarohia tēnei he mea nui. Ehara te whakamahi kino i tēnei putanga i te pepeke anga noa iho; ka huri hei arai katoa ina honoa ki ngā whirihoranga ngoikore, ki ngā pūmanawa waenga ngaro, ki ngā whakawhirinakitanga tawhito rānei.

Hei kati katoa i te porowhita:

  • Whakapai ake ki Laravel 11.30.1; koinei te tukunga kua papakihia.
  • Whakapakarihia tō CI/CD me ngā tirotiro putanga, ngā arotake taiao, me te whakamana huarahi haumaru.
  • Whakamahia ngā taputapu pēnei i a Xygeni ki te whai i ngā hanganga ngoikore, ngā ara morearea, me ngā whirihoranga tawhito kua takahia kētia.

Taupānga Hou ehara i te mea ko te tāpiri waehere anake; engari ko te tiaki i ngā mea katoa e karapoti ana: te taiao, ngā whakawhirinakitanga, te tuku pipeline, me ngā mahi a ngā kaiwhakawhanake. Pātakihia inaianei. Whaia te mōrearea. Maukati.

ngā taputapu-pūmanawa-sca-tātari-hanganga-pūmanawa
Whakaritea ngā āhuatanga matua, whakatikahia, me te tiaki i ngā mōrearea o ō pūmanawa
Tikina tō Pūkete Koreutu.
Kāore he kāri nama e hiahiatia.

Whakapūmau i tō Whakawhanaketanga me te Tukunga Pūmanawa

me te Huinga Hua Xygeni