Te Mahi a te Werohanga Tauira Taha-Tūmau i Muri i ngā Whakaaturanga
Ka puta he werohanga tauira taha-tūmau ina whakauruhia tika te tāuru a te kaiwhakamahi ki roto i te miihini tauira, ā, ka arotakehia me te kore he horoi tika, he wehenga rānei. Ka hangaia he ngoikoretanga SSTI e āhei ai te kaiwhakaeke ki te werohanga i ngā kawenga SSTI kua hangaia motuhaketia (hei tauira, {{7*7}} i roto i te Jinja2), ka arotakehia e te miihini, ka taea ai ngā mea katoa mai i te whakaaturanga raraunga ki te whakatinanatanga waehere matapōkere i roto i te horopaki tūmau. Nā te mea ka whakaatuhia e ngā miihini tauira rerekē ngā mea me ngā API rerekē, ka rerekē ngā kawenga SSTI i runga i te tūāpapa engari he rite tonu te mōrearea: ka tukuna e rātou te whakaurunga kore pono kia mawhiti i te rere o te whakaputa e tumanakohia ana, ā, ka whakahaerehia i roto i te wā oma o te tono, ka arahi pea ki te whakatinanatanga waehere mamao katoa, ki te nekehanga taha rānei mēnā ka waiho kia kore e tirohia.
Tauira iti rawa o te ngoikore i roto i te Jinja2
from flask import request, render_template_string @app.route("/hello") def hello(): name = request.args.get("name", "world") # ❌ Vulnerable: directly rendering user input return render_template_string("Hello " + name) Mena ka tukuna e te kaiwhakamahi ?ingoa={{7*7}}, ka arotakehia e te taupānga, ka whakahokia mai Kia ora 49He ngoikoretanga SSTI pukapuka matua tēnā.
Tauira iti rawa o te ngoikore i roto i te Twig
// ❌ Vulnerable Twig usage $template = $twig->createTemplate("Welcome " . $_GET['user']); echo $template->render([]); Ka taea e te kaiwhakaeke te wero i ngā kawenga SSTI pēnei i {{7*7}} hei whakamatau i te whakatinanatanga o te waehere. Te tūponotanga: ka taea e te werohanga māmā te piki ake ki te pānui i ngā kōnae, te whakahaere i ngā whakahau OS, te huri hōhonu atu rānei ki ngā hanganga.
Ngā Mahi a te Ao Tūturu: Ngā Utu SSTI e Whakaoho ana i te Whakahaere Waehere Mamao
Kia puta he ngoikoretanga SSTI, ka ngana ngā kaiwhakaeke ki te neke mai i te pāngarau whakamātautau-o-te-ariā ki te pāngarau katoa RCEHe rerekē te whakahaere a ngā miihini tauira rerekē i ngā kawenga.
Ngā utauta Jinja2
- {{7*7}} → te whakahaerenga taunga
- {{config.items()}} → ngā turuturu o ngā whirihoranga tūmau.
- {{ ”.__class__.__mro__[2].__subclasses__() }} → ara ki te RCE
Ngā kawenga tere
- #tautuhinga($x=”7″)${x} → te karo werohanga
- #tautuhinga($a=$class.tirotiro(“java.lang.WāOma”) → urunga tika i te wā whakahaere
Ngā utauta manga
- {{7*7}} → tātaitanga
- {{app.request.server.all}} → ngā taurangi taiao
- {{_self.env.registerUndefinedFilterCallback(‘system’)}} → te whakatinanatanga o te waehere
E whakaatu ana ēnei kawenga SSTI i te āhua o te ngoikore ōrite i roto i ngā miihini rerekē e arahi ana ki ngā momo rerekētanga. te whakamahi i ngā ara, engari he morearea tonu rātou.
Te wāhi e huna ai te Werohanga Tauira taha tūmau CI/CD-Ngā Taupānga Ārahi
Ehara i te mea he mōrearea taupānga tukutuku anake te werohanga tauira taha tūmau; ka puta mai i roto i hou CI/CD pipelines rawa. Ko ngā wāhi huna noa ko:
- Ngā tūtohi potae i roto i a Kubernetes, ka whakaatuhia ngā uara tauira i roto i te hihiri
- Kauira Īmēra e hono ana i ngā tāuru e whakahaerehia ana e te kaiwhakamahi
- Dashboards te wāhi e werohia ai ngā aho patai, ngā raraunga whirihora rānei ki roto i ngā tauira
- Ngā tuhinga DevOps e whakaputa ana i te HTML/Markdown mā te whakamahi i ngā miihini tauira.
tauira:
# ❌ Insecure Helm values with user input configMap: appMessage: "{{ .Values.message }}" If.Uara.karere mai i te tāuru kore whakawhirinaki, ka whakauruhia he werohanga tauira taha-tūmau ki roto i tō whakatinanatanga pipeline ake.
Te ārai i te SSTI mā te whakamahi i ngā Tauira Tauira Haumaru me te Tātaritanga Pūmau
Ko te whakaiti i ngā ngoikoretanga o te SSTI me whai tauira waehere pai ake me te kimi wawe.
Ngā tauira haumaru
- ❌ Kaua e whakamahia aho_tauira_whakaatu ranei ōrite
- ✅ Whakamahia ngā kōnae tauira kua tautuhia i mua, ā, tukuna ngā taurangi kua horoia
- ✅ Ngā miihini tauira pouaka onepu ina wātea
- ✅ Whakamanahia, ā, karohia te whakaurunga a te kaiwhakamahi i mua i te whakaputa
Te whakahaere pihikete kore haumaru me te whakahaere pihikete haumaru (mōrearea whakauru e pā ana)
# ❌ Insecure: session cookie without flags response.set_cookie("session", token) # ✅ Secure: session cookie hardened response.set_cookie("session", token, httponly=True, secure=True, samesite="Strict") Rārangi Arowhai Iti mō ngā Kaiwhakawhanake
- Kaua rawa e whakaatu tika i te tāurunga mata o te kaiwhakamahi
- Whakamahia ngā tauira pouaka onepu ina tautokona
- Whakakorehia, whakamanahia hoki ngā taurangi tauira katoa
- Āta karohia ngā kaiaromatawai tauira ritenga
- Matawaihia te waehere mō aho_tauira_whakaatu ngā tauira honohono aho rānei
Te tātari pateko ā, ka taea e ngā kaihanga riipene te tohu i ngā hanganga morearea i mua i te taenga ki te mahi whakaputa.
Te whakauru i ngā arowhai SSTI ki roto i te DevSecOps Pipelines
He iti ake te utu, he haumaru ake hoki te hopu wawe i te werohanga tauira taha-tūmau i te whakatika i muri mai. Me whakauru e ngā tīma DevSecOps ngā arowhai ki roto pipelines:
- Commit hooks: whakakore commitngā mahi mōrearea (aho_tauira_whakaatu)
- Ngā tātaritanga pūmau: matawaihia te mōrearea werohanga tauira taha tūmau i roto i te waehere tauira
- Whakamanatanga whakawhirinakitanga: tohu i ngā miihini tauira tawhito me ngā ngoikoretanga SSTI e mōhiotia ana
- Pipeline kuwaha: ka hanumi te poraka kia pahemo rā anō ngā arowhai SSTI
Mā te whakamahi i te kimi kawenga SSTI hei wāhanga o CI/CD, ka ārai koe i te tukunga o te waehere whakamahi kino.
Kaua e Tukua te Werohanga Tauira taha-tūmau kia Mahue ki roto i tō Puranga
Ka taea e te werohanga tauira taha-tūmau kotahi te whakanui ake i ngā mahi tinihanga pāngarau ({{7*7}}) ki te whakahaere katoa i te waehere mamao. Kāore ngā ngoikoretanga SSTI e puta noa i roto i ngā taupānga tukutuku engari i roto hoki i CI/CD pipelines, ngā tūtohi Helm, me ngā tauira īmēra.
Take take
- Kaua rawa e whakaatu i te tāurunga mata o te kaiwhakamahi ki roto i ngā tauira
- Whakamanahia, ā, horoia hoki ngā taurangi hihiri katoa
- He rerekē ngā kawenga SSTI o ngā miihini rerekē (Jinja2, Velocity, Twig), engari ka taea katoa te whakamahi hei patu.
- Whakamahia te tātaritanga pūmau me ngā kēti tere-raru i roto i pipelines
- Arotakehia ngā tauira i roto i tō puranga i ia wā, i ia wā
Nga taputapu penei Xygeni āwhina i ngā tīma ki te kite i te whakamahinga tauira morearea, te aukati i ngā ngoikoretanga SSI, me te whakatinana i ngā mahi haumaru puta noa pipelineme ngā whakawhirinakitanga. I roto i te DevSecOps, he mea nui te whakaaro ki ngā kawenga SSTI hei mōrearea taumata-teitei nā te mea kotahi te werohanga ki roto i tō pipeline ka taea e te taupānga rānei te whakararu i tō taiao katoa.
