TL; DR
Chigwirizano cha axios npm chikuwonetsa momwe maunyolo amakono operekera zinthu akuukira kugwiritsa ntchito njira zodalirika zopezera deta yachinsinsi panthawi yogwira ntchito. Chochitikachi chawunikidwa ndi ofufuza ambiri achitetezo, kuphatikizapo kusanthula mwatsatanetsatane kuchokera ku Unit42 Kufotokozera za makampani kukuwonetsa njira zowerengera zomwe zimagwirizana ndi ntchito za dziko ndi boma.
Chochitika ichi chimakhudza:
- Magulu a DevOps akuthamanga CI/CD pipelines yokhala ndi kutsimikizika kochokera ku chilengedwe
- Ntchito za Backend zomwe zikugwira ntchito yopempha API yovomerezeka
- Mapulogalamu ogwiritsa ntchito ma axios polumikizirana mkati ndi kunja kwa HTTP
Chifukwa chakuti axios ili mu gawo lopempha, mtundu wosokonekera ukhoza kupeza:
- Mitu yovomerezeka ndi Zizindikiro za API
- Zosintha zachilengedwe ndi zinsinsi
- Kulankhulana kwa ntchito zamkati
Zotsatira zenizeni si kudalira kokha, koma zomwe zingatheke zikachitika.
Zochita nthawi yomweyo:
- Tsekani mitundu yodalira ndikuwunikanso zosintha zaposachedwa
- Zungulirani makiyi a API, ma tokeni, ndi CI/CD zizindikiro
- Yang'anirani zopempha zotuluka ndi ntchito yotsimikizira
- Audit pipelineza zinsinsi zowululidwa
Zomwe Zinachitika mu Axios npm Attack
Chochitika cha axios chikutsatira njira yomwe ikukula mu ziwopsezo zogulira zinthu, pomwe owukira amayang'ana kwambiri kudalira komwe kumagwiritsidwa ntchito kwambiri m'malo mwa zovuta zomwe zimagwiritsidwa ntchito.
Mwa kusokoneza phukusi lodalirika, owukira amapeza kuphedwa mkati mwa malo zikwizikwi nthawi imodzi.
Popeza axios ndi imodzi mwa makasitomala a HTTP omwe amagwiritsidwa ntchito kwambiri mu JavaScript, imaphatikizidwa kwambiri mu:
- Ntchito za backend
- Mapulogalamu a kutsogolo
- CI/CD pipelines
Izi zimapangitsa kuti ikhale chandamale chamtengo wapatali.
Mtundu woipa ukangoyambitsidwa ndikugwiritsidwa ntchito, umalandira zilolezo zomwezo monga momwe pulogalamu yomwe idalowetsa. Izi zikuphatikizapo mwayi wopeza kuchuluka kwa magalimoto pa netiweki, ziphaso, ndi mautumiki amkati.
Mgwirizanowu udakopa chidwi chachikulu kuposa gulu lachitetezo, ndi malipoti monga Axios Kuphunzira
kusonyeza maubwenzi omwe angakhalepo ndi anthu omwe ali ndi ziwopsezo zapamwamba komanso ma kampeni ogwirizana.
Zimene Axios Attack Imachita Kwenikweni pa Runtime
Chinsinsi chomvetsetsa kuukira kumeneku ndikuyang'ana kwambiri momwe zinthu zilili nthawi yogwirira ntchito.
Axios imagwira ntchito pa HTTP layer, zomwe zikutanthauza kuti imagwira ntchito ndi mapempho otuluka. Izi zimapangitsa kuti izioneka mwachindunji mu data yachinsinsi yomwe ikuyenda mu pulogalamuyo.
Mtundu wosokonekera ukhoza:
- Landirani zopempha zotuluka musanatumize
- Jambulani
Authorizationmitu ndi ma API token - Pezani zosintha zachilengedwe kudzera mu
process.env - Yang'anirani kulumikizana pakati pa mautumiki amkati
Mwachitsanzo, cholumikizira cholakwika chingatulutse mitu yotsimikizira ndikuyitumiza mwakachetechete ku endpoint yakunja.
Nthawi yomweyo, mwayi wopeza zosintha zachilengedwe umalola owukira kuti apeze ziyeneretso popanda kusintha malingaliro a pulogalamu.
Kuchokera kunja, chilichonse chikugwira ntchito monga momwe amayembekezera. Zopempha zimamalizidwa bwino, mautumiki amayankhidwa mwachizolowezi, ndipo pipelines sizikuwonetsa zizindikiro za kulephera. Nthawi yomweyo, deta yofunikira ikhoza kuwululidwa kale kudzera m'njira zoyendetsera ntchito zakumbuyo.
Kuyenda kwa Axios Attack: Kuchokera ku Phukusi Lokhala ndi Mavuto Okhudza Kuzindikira Zinthu Mobisa
1. Kulolerana
Wowukira amapeza ulamuliro pa akaunti yodalirika ya wosamalira kapena njira yotulutsira phukusi mkati mwa dongosolo la axios.
2. Kugawa
Mabaibulo oipa amafalitsidwa ku npm ndikukokedwa mu makina opanga mapulogalamu, CI/CD pipelines, ndipo pulogalamu imapangidwira kudzera mu zosintha zachizolowezi zodalira.
3. Kugwira Ntchito Nthawi Yogwirira Ntchito
Kulipira kumachitika pamene axios yalowetsedwa ndikugwiritsidwa ntchito, kulandira mwayi wofanana ndi wa pulogalamuyo.
4. Kulowa Mwachinsinsi
Kudalira komwe kwasokonekera kumaonekera m'ma headers, token, environment variables, ndi internal HTTP communication.
5. Kutulutsa madzi m'thupi
Deta yobisika imatumizidwa mwakachetechete ku zomangamanga zolamulidwa ndi owukira pomwe zopempha zoyambirira zikupitiliza kugwira ntchito bwino.
Zizindikiro za Kugwirizana (IoCs)
Kuti afufuze zomwe zingachitike, magulu ayenera kuyamba ndikuwunikanso zizindikiro zodziwika bwino zokhudzana ndi mgwirizano wa axios. Gome ili pansipa likufotokoza mwachidule zizindikiro zofunika kwambiri pamapaketi, ntchito za netiweki, ndi zinthu zina zomwe zimasungidwa.
Momwe Mungatanthauzire Ma IoC Awa
Ngakhale zizindikiro izi ndi zothandiza, siziyenera kuonedwa ngati njira yodziwira matenda yonse.
Mwachizolowezi, ziwopsezo ngati izi sizimadalira chizindikiro chimodzi chokhazikika. Ma domain amasintha, katundu wolipidwa amasintha, ndipo ma hashes amatha ntchito mwachangu. Chomwe chimakhala chofanana ndi khalidwe.
Mwachitsanzo, mapempho osayembekezereka otuluka panthawi yogwiritsira ntchito HTTP yachizolowezi angasonyeze kuti deta yachotsedwa. Mofananamo, kugwiritsa ntchito ziyeneretso zovomerezeka m'malo osazolowereka nthawi zambiri kumasonyeza kuti zinsinsi zavumbulidwa kale.
Pa mlingo wa host, kupezeka kwa ma script osakhalitsa kapena ma binary kungasonyeze zochitika pambuyo pa kugwiritsidwa ntchito molakwika, makamaka zikaphatikizidwa ndi zolakwika za netiweki.
Mwa kuyankhula kwina, ma IoC amakuthandizani kutsimikizira chochitika.
Komabe, kumvetsetsa khalidwe ndiko kumakupatsani mwayi wozindikira msanga.
| Category | chizindikiro | tsatanetsatane |
|---|---|---|
| phukusi | axios@1.14.1 | shasum: 2553649f2322049666871cea80a5d0d6adc700ca |
| phukusi | axios@0.30.4 | shasum: d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 |
| wodalira | plain-crypto-js@4.2.1 | shasum: 07d889e2dadce6f3910dcbc253317d28ca61c766 |
| Network | sfrclak[.]com | Dongosolo lolamulira ndi kulamulira |
| Network | 142.11.206[.]73 | IP yogwirizana ndi zomangamanga |
| Network | http://sfrclak[.]com:8000/6202033 | Mapeto a kutuluka kwa zinthu zofewa adawonedwa |
| macOS | /Library/Caches/com.apple.act.mond | SHA256: 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a |
| Windows | %PROGRAMDATA%\wt.exe | Chinthu chokhazikika chomwe chingathe kuchitika |
| Windows | %TEMP%\6202033.vbs | Zinthu zakale zogwiritsidwa ntchito pogwiritsa ntchito script |
| Windows | %TEMP%\6202033.ps1 | Kutsitsa kwa PowerShell. SHA256: 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 |
| Linux | /tmp/ld.py | SHA256: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf |
Chidziwitso cha kafukufuku: Ma IoC awa ndi poyambira pothandiza pakusaka ziwopsezo. Komabe, owukira amatha kusintha ma domain, ma payload, ndi zinthu zakale mwachangu. Pachifukwa ichi, magulu ayenera kulumikiza zizindikiro izi ndi zizindikiro za khalidwe monga kuchuluka kwa magalimoto osayembekezereka a HTTP, mwayi wolowera wosadziwika bwino process.env, ndi zosintha zachilendo zodalira.
Chitsanzo: Momwe Kudalira kwa Axios npm Komwe Kungathe Kutulutsira Deta
Kuti mumvetse momwe kuukira kwa Axios npm kumagwirira ntchito, taganizirani chitsanzo chosavuta.
Axios imalola opanga mapulogalamu kupanga ma interceptor opempha. Ma interceptor awa amagwira ntchito okha musanapemphe chilichonse cha HTTP.
Mtundu woipa wa axios ukhoza kugwiritsa ntchito molakwika njira iyi:
Chifukwa Chake Kuukira kwa Axios npm Kuli Koopsa
Poyamba, palibe chomwe chikuoneka cholakwika. Pempho lachitika bwino, pempholo likuchita monga momwe likuyembekezeredwa, ndipo pipelinepitirizani kudutsa popanda zolakwika.
Komabe, tsatanetsatane wofunikira umachitika pempho lisanatumizidwe. Pa nthawi yogwiritsira ntchito, kudalira komwe kwasokonezedwa kumatha kupeza ndikusonkhanitsa deta yachinsinsi monga mitu yovomerezeka, ma API token, metadata ya pempho, ndi zosintha zachilengedwe.
Popeza mfundo imeneyi imagwira ntchito mkati mwa laibulale yodalirika yomwe ili mwachindunji mu njira yopempha HTTP, imagwira ntchito bwino ndi mwayi womwewo monga pulogalamuyo yokha. Zotsatira zake, imatha kupeza deta yomwe nthawi zambiri imatetezedwa ku zigawenga zakunja.
Chomwe chimapangitsa izi kukhala zoopsa kwambiri si kungopeza deta yokha, komanso kusowa kwa zotsatira zooneka. Palibe kusokonezeka kwa magwiridwe antchito, palibe zopempha zomwe zalephera, komanso palibe chizindikiro chodziwikiratu kuti pali cholakwika. Kuchokera pakuwona momwe zinthu zilili, chilichonse chikupitilizabe kugwira ntchito monga momwe timayembekezera.
Pakadali pano, chidziwitso chachinsinsi chikhoza kukhala chikutuluka kale mu dongosolo kudzera mu maulumikizidwe otuluka omwe amasakanikirana ndi kuchuluka kwa anthu omwe amalowa mu pulogalamu.
Chifukwa Chake Ili Ndi Vuto la DevOps Choyamba
Kwa magulu a DevOps, mtundu uwu wa kuukira ndi wovuta kwambiri kuzindikira chifukwa umalumikizana bwino ndi njira zomwe zilipo kale.
Zodalira zimayikidwa zokha, pipelineamachita zinthu mwachizolowezi, ndipo palibe zolephera zomwe zimachitika nthawi yomweyo.
Nthawi yomweyo, CI/CD Malo ozungulira nthawi zambiri amawonetsa ziyeneretso zamtengo wapatali, kuphatikizapo:
- Ma tokeni a opereka mitambo
- Makiyi otumizira
- CI/CD zinsinsi zotsimikizira
Kudalira komwe kukuchitika motere kumatha kupeza ziyeneretso zimenezo mwachindunji.
Izi zimapangitsa kuti chilichonse chiwoneke ngati chabwinobwino, pomwe deta yachinsinsi ikupezedwa kumbuyo.
Chiwopsezo Chenicheni: Kuwonekera Mobisa Pachimake
Kugwirizana kwa axios npm kukuwonetsa kusintha kwakukulu pa njira zamakono zowukira.
Cholinga sichikugwiritsanso ntchito zinthu zofooka, koma kupeza ziphaso zovomerezeka.
Popeza machitidwe amakono amadalira kutsimikizika kochokera ku chilengedwe, kudalira komwe kukuyenda nthawi yogwirira ntchito kumatha kupeza:
- Makiyi a API
- Zizindikiro zautumiki
- Zikalata za mtambo
Ziyeneretso izi siziyenera kusweka.
Ayenera kugwiritsidwa ntchito okha.
Izi zimathandiza owukira kusuntha mbali zonse, kupeza mautumiki, ndikutulutsa deta pogwiritsa ntchito kutsimikizira kovomerezeka.
Motero, zotsatira zake zimadalira zinsinsi zomwe zawululidwa, osati momwe kuukirako kuchitidwira.
Chifukwa Chake Zida Zachitetezo Zachikhalidwe Zikusowa Izi
Njira zachikhalidwe zimavutika kuzindikira ziwopsezo izi chifukwa zimayang'ana kwambiri pa zofooka zodziwika kapena zizindikiro zosasinthika. Komabe, monga momwe zasonyezedwera mu Kusanthula kwa OpenAI Pa mgwirizano wa axios developer tool, chiopsezo chenicheni chimabwera nthawi yogwirira ntchito, pomwe zodalira zodalirika zimalumikizana ndi deta yachinsinsi.
Komabe, kudalira komwe kwasokonekera sikungakhale ndi zizindikiro zoonekeratu.
Pakhoza kukhala:
- Palibe CVE
- Palibe siginecha yoipa
- Palibe kalembedwe kosayenera
Nthawi yomweyo, kusanthula kosasintha sikuwunika momwe ntchito ikuyendera. Singathe kudziwa momwe kudalira kumagwirira ntchito ndi deta yachinsinsi ikangochitika.
Izi zimapangitsa kuti pakhale kusiyana komwe ma code amaoneka otetezeka panthawi yowunikira koma amakhala oopsa panthawi yogwira ntchito.
Momwe Mungadziwire ndi Kuletsa Kuukira kwa Axios npm-Like
Kupewa mtundu uwu wa kuukira kwa Axios npm kumafuna kusintha kuchoka pa kuyang'anira kosasintha kupita ku kuzindikira nthawi yogwirira ntchito.
Magulu amafunika kudziwa momwe anthu odalirana amachitira zinthu, osati zomwe zili mkati mwake.
Izi zikuphatikizapo:
- Kuwunika mwayi wopeza deta yachinsinsi panthawi yogwira ntchito
- Kuzindikira zinsinsi zisanafike ku malo osungiramo zinthu
- Kusinthanitsa pipelinezinthu zakale ndi zolembedwa za ziphaso zowonekera
- Kuwona zochitika za netiweki yotuluka kuti mudziwe zolakwika
Komabe, kuzindikira kokha sikokwanira.
Kuchokera pa Kuzindikira mpaka Kupewa: Chomwe Chimachepetsa Chiwopsezo
Pambuyo pa chochitika chonga ichi, magulu nthawi zambiri amakumana ndi ziyeneretso zambiri zomwe zingawonekere.
Vuto si kuwapeza, koma kudziwa omwe ali ofunika.
Funso lofunika kwambiri ndi lakuti:
Ndi zinsinsi ziti zomwe zidakali zovomerezeka komanso zomwe zingagwiritsidwe ntchito?
Popanda kutsimikizira, magulu amathera nthawi yambiri pa ziphaso zosagwira ntchito pomwe zoopsa zenizeni zimakhalabe zotseguka.
Yankho logwira mtima limafuna:
- Kuzindikira zinsinsi zowululidwa
- Kutsimikizira ngati akuperekabe mwayi wolowa
- Kuzisintha kapena kuzisintha mwachangu
Izi zimachepetsa nthawi yowonekera komanso zimachepetsa nthawi ya wowukirayo.
Momwe Xygeni Imathandizira Kuchepetsa Chiwopsezo cha Unyolo Wopereka
Xygeni Amathetsa vutoli mwa kuphatikiza kuzindikira, kutsimikizira, ndi kukonzanso mu njira imodzi yogwirira ntchito.
Imazindikira zinsinsi zobisika nthawi zonse kudzera mu code, pipelines, ndi zinthu zakale. Nthawi yomweyo, zimatsimikiza ngati ziyeneretso zimenezo zikugwirabe ntchito m'chilengedwe.
Izi zimathandiza magulu kuti aziganizira kwambiri zomwe owukira angagwiritse ntchito.
Zinsinsi zogwira ntchito zikadziwika, njira zodzikonzera zokha zimathandiza kuchepetsa nthawi yowonekera kudzera mu kuchotsedwa kapena kuzungulira kolamulidwa.
Zotsatira zake, kuyankha kumakhala kofulumira, koyambiriracise, ndipo sizisokoneza kwambiri.
Kutsiliza
Kugwirizana kwa axios npm kukuwonetsa momwe ziwopsezo za supply chain zikusinthira.
Owukira sakufunikanso kuswa machitidwe. Amadalira zodalira zodalirika kuti apeze deta yachinsinsi panthawi yogwira ntchito.
Kwa magulu a DevOps, izi zikutanthauza kumvetsetsa momwe zinthu zilili nthawi yogwirira ntchito. Kwa atsogoleri achitetezo, zikutanthauza kuchepetsa kukhudzidwa ndi zinthu mwachangu komanso moyenera.
Chifukwa m'malo amakono, chiopsezo chachikulu si chomwe chimachitidwa.
Ndi zomwe zimafika zikayamba kugwira ntchito.
