TL; DR
I-axios npm compromise ibonisa indlela uhlaselo lwanamhlanje lwe-supply chain sebenzisa ukuxhomekeka okuthembekileyo ukufikelela kwidatha eyimfihlo ngexesha lokusebenza. Esi siganeko sihlalutywe ngabaphandi abaninzi bezokhuseleko, kuquka uhlalutyo oluneenkcukacha oluvela kwi Iyunithi42 ukugubungela ishishini okugxininisa iipatheni zokwabiwa kwezinto ezinxulumene nomsebenzi wesizwe.
Esi siganeko sichaphazela:
- Amaqela eDevOps asebenzayo CI/CD pipelines ngokuqinisekiswa okusekelwe kwindalo esingqongileyo
- Iinkonzo ze-Backend ezisingatha izicelo ze-API eziqinisekisiweyo
- Izicelo ezisebenzisa i-axios kunxibelelwano lwangaphakathi nolwangaphandle lwe-HTTP
Ngenxa yokuba i-axios ikwimaleko yesicelo, inguqulelo echaphazelekileyo inokufikelela:
- Iintloko zemvume kunye Iimpawu ze-API
- Izinto eziguquguqukayo kunye neemfihlo zendalo
- Unxibelelwano lwenkonzo yangaphakathi
Impembelelo yokwenyani ayikokuxhomekeka ngokwako, kodwa koko inokufikelela kuko xa sele kwenziwe.
Izenzo kwangoko:
- Tshixa iinguqulelo zokuxhomekeka kwaye uhlole uhlaziyo lwakutshanje
- Jikelezisa izitshixo ze-API, iithokheni, kunye CI/CD iinkcukacha
- Jonga izicelo eziphumayo kunye nomsebenzi wokuqinisekisa
- Uphicotho pipelines yeemfihlo eziveziweyo
Kwenzeka ntoni kwi-Axios npm Attack
Isiganeko se-axios silandela indlela ekhulayo yokuhlaselwa kwe-supply chain, apho abahlaseli bajolise ekuxhomekekeni okusetyenziswa kakhulu endaweni yobuthathaka besicelo.
Ngokubeka emngciphekweni iphakheji ethembekileyo, abahlaseli bafumana ukuphunyezwa ngaphakathi kwamawaka eendawo ngaxeshanye.
Ngenxa yokuba i-axios yenye yezona klayenti ze-HTTP ezisetyenziswa kakhulu kwi-JavaScript ecosystem, idityaniswe nzulu kwi:
- Iinkonzo zasemva
- Usetyenziso lwangaphambili
- CI/CD pipelines
Oku kuyenza ibe yeyona nto iphambili ekujoliswe kuyo.
Nje ukuba inguqulelo enobungozi ingeniswe kwaye iphunyezwe, ifumana iimvume ezifanayo nezo zingeniswe yi-app. Oko kuquka ukufikelela kwi-traffic yenethiwekhi, iziqinisekiso, kunye neenkonzo zangaphakathi.
Le mvumelwano ikwafumene ingqalelo ebanzi ngaphaya koluntu lokhuseleko, ngeengxelo ezifana ne-Axios Ukufihla
ekhomba kwiindlela ezinokubakho zokunxibelelana nabantu abaphambili abasongelayo kunye neephulo ezidibeneyo.
Oko kwenziwa yi-Axios Attack ngexesha lokuqalisa
Eyona nto ibalulekileyo ekuqondeni olu hlaselo kukugxila kwindlela esebenza ngayo ngexesha lokusebenza.
I-Axios isebenza kwi-HTTP layer, oko kuthetha ukuba iphatha izicelo eziphumayo. Oku kuyinika ukubonakala ngokuthe ngqo kwidatha eyimfihlo ehamba ngaphakathi kwesicelo.
Inguqulelo echaphazelekileyo inga:
- Nqanda izicelo eziphumayo ngaphambi kokuba zithunyelwe
- Capture
Authorizationii-headers kunye nee-API token - Fikelela kwiinguqu zendalo ngokusebenzisa
process.env - Jonga unxibelelwano phakathi kweenkonzo zangaphakathi
Umzekelo, i-interceptor enobuthi inokukhupha ii-headers zokuqinisekisa ize izithumele buthule kwindawo yangaphandle.
Kwangaxeshanye, ukufikelela kwiinguqu zendalo kuvumela abahlaseli ukuba bafumane iziqinisekiso ngaphandle kokutshintsha ingqiqo yesicelo.
Ngaphandle, yonke into iyaqhubeka nokusebenza njengoko bekulindelwe. Izicelo zigqitywa ngempumelelo, iinkonzo ziphendulwa ngokuqhelekileyo, kwaye pipelines azibonisi zimpawu zokusilela. Kwangaxeshanye, idatha eyimfihlo isenokuba sele iveziwe ngeendlela zokuphumeza ezingasemva.
Ukuhamba kohlaselo lwe-Axios: Ukusuka kwiphakheji ebuthathaka ukuya ekubonakalisweni okuyimfihlo
1. Ukulalanisa
Umhlaseli ufumana ulawulo kwiakhawunti yomgcini othembekileyo okanye indlela yokukhululwa kwephakheji ngaphakathi kwenkqubo ye-axios.
2. Ukuhanjiswa
Iinguqulelo ezinobungozi zipapashwa kwi-npm kwaye zitsalwe kwiimashini zomphuhlisi, CI/CD pipelines, kwaye usetyenziso lwakhiwa ngohlaziyo oluqhelekileyo lokuxhomekeka.
3. Ukuphunyezwa kwexesha lokusebenza
Umthwalo womvuzo usebenza xa i-axios ingeniswa kwaye isetyenziswa, ifumana amalungelo afanayo exesha lokusebenza njengesicelo.
4. Ukufikelela Ngokufihlakeleyo
Ukuxhomekeka okubuthathaka kuzuza ukubonakala kwii-headers, ii-token, ii-environment variables, kunye nonxibelelwano lwangaphakathi lwe-HTTP.
5. Ukukhupha amanzi emzimbeni
Idatha ebuthathaka ithunyelwa buthule kwiziseko ezilawulwa ngabahlaseli ngelixa izicelo zokuqala ziqhubeka nokusebenza ngokuqhelekileyo.
Iimpawu zeCompromise (IoCs)
Ukuze kuphandwe ngokuchatshazelwa okunokwenzeka, amaqela kufuneka aqale ngokuphonononga izalathisi ezaziwayo ezinxulumene nokungavisisani kwe-axios. Itheyibhile engezantsi ishwankathela imiqondiso efanelekileyo kwiipakethe, umsebenzi wenethiwekhi, kunye nezinto ezisetyenziswa ngumsingathi.
Indlela yokutolika ezi IoCs
Nangona ezi mpawu ziluncedo, akufanele zithathwe njengecebo elipheleleyo lokuchonga.
Enyanisweni, uhlaselo olunje aluxhomekeki kakhulu kwisignali enye engashukumiyo. Iidomeyini ziyatshintsha, imithwalo yentlawulo iyaguquka, kwaye ii-hashes ziphelelwa lixesha ngokukhawuleza. Okuhlala kufana yindlela yokuziphatha.
Umzekelo, izicelo ezingalindelekanga eziphumayo ngexesha lokuphunyezwa kwe-HTTP eqhelekileyo zinokubonisa ukukhutshwa kwedatha. Ngokufanayo, ukusetyenziswa kweziqinisekiso ezisemthethweni kwiimeko ezingaqhelekanga kudla ngokubonisa ukuba iimfihlo sele zityhiliwe.
Kwinqanaba lomsingathi, ukubakho kwezikripthi zexeshana okanye ii-binary kunokubonisa umsebenzi wasemva kokuxhatshazwa, ingakumbi xa zidityaniswe nokungahambi kakuhle kwenethiwekhi.
Ngamanye amazwi, ii-IoCs zikunceda uqinisekise isiganeko.
Nangona kunjalo, ukuqonda indlela yokuziphatha yikona okukuvumela ukuba uyibone kwangethuba.
| udidi | Isalathisi | iinkcukacha |
|---|---|---|
| ipakethe | axios@1.14.1 | shasum: 2553649f2322049666871cea80a5d0d6adc700ca |
| ipakethe | axios@0.30.4 | shasum: d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 |
| ukuXhomekeka | plain-crypto-js@4.2.1 | shasum: 07d889e2dadce6f3910dcbc253317d28ca61c766 |
| womnatha | sfrclak[.]com | Idomeyini yomyalelo nolawulo |
| womnatha | 142.11.206[.]73 | I-IP yeziseko zophuhliso ezinxulumeneyo |
| womnatha | http://sfrclak[.]com:8000/6202033 | Isiphelo sokukhupha amanzi sibonwe |
| Mac | /Library/Caches/com.apple.act.mond | I-SHA256: 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a |
| Windows | %PROGRAMDATA%\wt.exe | Izinto ezinokwenzeka zokunyamezela |
| Windows | %TEMP%\6202033.vbs | I-artifact yokwenziwa okusekwe kwiskripthi |
| Windows | %TEMP%\6202033.ps1 | Umthwalo wePowerShell. SHA256: 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 |
| Linux | /tmp/ld.py | I-SHA256: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf |
Inqaku lophando: Ezi IoCs ziyindawo eluncedo yokuqala ukuzingela usongo. Nangona kunjalo, abahlaseli banokutshintshatshintsha iidomeyini, imithwalo, kunye nezinto zakudala ngokukhawuleza. Ngenxa yeso sizathu, amaqela kufuneka adibanise ezi zibonakaliso neempawu zokuziphatha ezifana nethrafikhi ye-HTTP engalindelekanga, ukufikelela okungaqhelekanga kwi process.env, kunye nohlaziyo olungaqhelekanga lokuxhomekeka.
Umzekelo: Indlela i-Axios npm Dependency enokuchasana ngayo nokukhupha idatha
Ukuze uqonde indlela olu hlaselo lwe-Axios npm olusebenza ngayo xa lusenziwa, cinga ngomzekelo olula.
I-Axios ivumela abaphuhlisi ukuba bachaze ii-interceptors zesicelo. Ezi interceptors zisebenza ngokuzenzekelayo ngaphambi kwesicelo ngasinye se-HTTP.
Inguqulelo enobungozi ye-axios ingayisebenzisa kakubi le ndlela:
Kutheni i-Axios npm Attack iyingozi
Ekuqaleni, akukho nto ibonakala ingalunganga. Isicelo siphunyeziwe ngempumelelo, isicelo sisebenza njengoko bekulindelekile, kwaye pipelines ziyaqhubeka zidlula ngaphandle kweempazamo.
Nangona kunjalo, iinkcukacha ezibalulekileyo zenzeka ngaphambi kokuba isicelo sithunyelwe. Ngexesha lelo thuba lokuphunyezwa, ukuxhomekeka okuphazamisekileyo kunokufikelela buthule kwaye kuqokelele idatha ebucayi efana neentloko zogunyaziso, iithokheni ze-API, i-metadata yesicelo, kunye neenguqu zendalo.
Ngenxa yokuba le ngqiqo isebenza ngaphakathi kwilayibrari ethembekileyo ehleli ngqo kwindlela yesicelo se-HTTP, isebenza ngempumelelo ngamalungelo afanayo nesicelo ngokwaso. Ngenxa yoko, inokufikelela kwidatha ebingakhuseleka kubahlaseli bangaphandle.
Okwenza oku kube yingozi kakhulu akukokufikelela kwidatha kuphela, kodwa kukungabikho kwempembelelo ebonakalayo. Akukho kuphazamiseka kokusebenza, akukho zicelo zingaphumelelanga, kwaye akukho mqondiso ukhawulezileyo wokuba kukho into engalunganga. Ngokwembono yokusebenza, yonke into iyaqhubeka nokusebenza njengoko bekulindelekile.
Okwangoku, ulwazi oluyimfihlo lusenokuba sele luphuma kwinkqubo ngokusebenzisa uqhagamshelo oluphumayo oludibana nethrafikhi yesicelo eqhelekileyo.
Kutheni le nto iyingxaki ye-DevOps kuqala
Kumaqela eDevOps, olu hlobo lohlaselo kunzima kakhulu ukulubona kuba ludibana ngokulula neendlela zokusebenza ezikhoyo.
Izinto ezixhomekeke kuzo zifakwa ngokuzenzekelayo, pipelines zisebenza ngokuqhelekileyo, kwaye akukho kusilela kwangoko kwenzekayo.
Ngaxeshanye, CI/CD iindawo ezihlala ziveza iziqinisekiso ezixabisekileyo, kuquka:
- Iithokheni zomboneleli welifu
- Amaqhosha okusasaza
- CI/CD iimfihlo zokuqinisekisa
Ukuxhomekeka okubuthathaka okusebenzayo kule meko kunokufikelela kwezo ziqinisekiso ngokuthe ngqo.
Oku kudala imeko apho yonke into ibonakala iqhelekile, ngelixa idatha eyimfihlo ifunyanwa ngasemva.
Umngcipheko Wokwenene: Ukutyhileka Okuyimfihlo Kwizinga Eliphezulu
I-axios npm compromise igxininisa utshintsho olubalulekileyo kwiindlela zokuhlasela zanamhlanje.
Injongo ayisekho kukusebenzisa ubuthathaka, kodwa kukufikelela kwiinkcukacha ezisemthethweni.
Ngenxa yokuba iinkqubo zanamhlanje zixhomekeke ekuqinisekisweni okusekwe kwindalo esingqongileyo, ukuxhomekeka okusebenzayo ngexesha lokusebenza kunokufikelela:
- API izitshixo
- Iithokheni zenkonzo
- Iziqinisekiso zelifu
Ezi ziqinisekiso akufuneki ziphulwe.
Zifuna ukusetyenziswa kuphela.
Oku kwenza abahlaseli bakwazi ukuhambisa ecaleni, ukufikelela kwiinkonzo, kunye nokukhupha idatha besebenzisa uqinisekiso olusemthethweni.
Ngenxa yoko, impembelelo ixhomekeke kwiimfihlo ezityhilwayo, kungekhona kwindlela oluhlaselo oluqhutywa ngayo.
Kutheni Izixhobo Zokhuseleko Zemveli Ziphosakele Oku?
Iindlela zemveli ziyasokola ukubona olu hlaselo kuba zigxila kwiindawo ezaziwayo zobuthathaka okanye kwiimpawu ezingashukumiyo. Nangona kunjalo, njengoko kubonisiwe kwi Uhlalutyo lwe-OpenAI kwi-axios developer tool compromise, umngcipheko wokwenyani uvela ngexesha lokusebenza, apho ukuxhomekeka okuthembekileyo kudibana nedatha eyimfihlo.
Nangona kunjalo, ukuxhomekeka okuncitshisiweyo kusenokungabi nazo naziphi na iimpawu ezicacileyo.
Kusenokubakho:
- Akukho CVE
- Akukho siginesha yobubi
- Akukho sintaksi ingaqhelekanga
Kwangaxeshanye, uhlalutyo oluzinzileyo aluvavanyi indlela yokusebenza kwexesha lokusebenza. Alunakucacisa indlela ukuxhomekeka okunxibelelana ngayo nedatha eyimfihlo xa sele yenziwe.
Oku kudala umsantsa apho ikhowudi ibonakala ikhuselekile ngexesha lohlalutyo kodwa iba yingozi ngexesha lokwenziwa.
Indlela yokuFumanisa nokuthintela ii-Axios npm-Like Attacks
Ukuthintela olu hlobo lohlaselo lwe-Axios npm kufuna utshintsho oluvela ekuhlolweni okungaguqukiyo ukuya ekuqapheleni ixesha lokusebenza.
Amaqela adinga ukubonwa ngendlela eziziphatha ngayo izinto ezixhomekeke kwabanye, kungekuphela nje koko zikuko.
Oku kubandakanya:
- Ukubeka iliso ekufikeleleni kwidatha ebucayi ngexesha lokusebenza
- Ukufumanisa iimfihlo ngaphambi kokuba zifike kwiindawo zokugcina izinto
- Ukukhangela pipelineizinto kunye nezinto ezisetyenzisiweyo zeziqinisekiso eziveziweyo
- Ukujonga imisebenzi yenethiwekhi ephumayo ukuze ufumane izinto ezingaqhelekanga
Nangona kunjalo, ukufumanisa kuphela akwanelanga.
Ukusuka Ekufumaneni Ukuya Ekuthinteleni: Yintoni Eyehlisa Umngcipheko
Emva kwesiganeko esifana nesi, amaqela adla ngokujongana nenani elikhulu leziqinisekiso ezinokuthi zityhileke.
Umngeni asikokuzifumana. Kukuchonga ukuba zeziphi ezibalulekileyo.
Umbuzo ophambili uba:
Zeziphi iimfihlo ezisasebenza kwaye zisebenziseka lula?
Ngaphandle kokuqinisekiswa, amaqela achitha ixesha kwiziqinisekiso ezingasebenziyo ngelixa iingozi zokwenyani zisevulekile.
Impendulo esebenzayo ifuna:
- Ukufumanisa iimfihlo eziveziweyo
- Ukuqinisekisa ukuba basanika imvume yokufikelela na
- Ukuzirhoxisa okanye ukuzijikelezisa ngokukhawuleza
Oku kunciphisa ixesha lokuvezwa kwaye kunciphisa ifestile yomhlaseli.
Indlela iXygeni enceda ngayo ekunciphiseni umngcipheko wekhonkco lobonelelo
I-Xygeni Ijongana nale ngxaki ngokudibanisa ukufumanisa, ukuqinisekisa, kunye nokulungisa umsebenzi omnye.
Ihlala ichonga iimfihlo eziveziweyo kwikhowudi, pipelines, kunye nezinto zakudala. Kwangaxeshanye, iqinisekisa ukuba ezo ziqinisekiso zisasebenza na kwimeko-bume.
Oku kuvumela amaqela ukuba agxile koko abahlaseli banokukusebenzisa ngokwenene.
Nje ukuba iimfihlo ezisebenzayo zichongiwe, imisebenzi yokulungisa ezenzekelayo inceda ukunciphisa ixesha lokuvezwa ngokurhoxiswa okanye ukujikeleza okulawulwayo.
Ngenxa yoko, impendulo iba ngokukhawuleza, ibe ngconocise, kwaye ayiphazamisi kangako.
isiphelo
I-axios npm compromise ibonisa indlela uhlaselo lwe-supply chain olutshintsha ngayo.
Abahlaseli abasadingi kwaphula iinkqubo. Baxhomekeke kwiindlela ezithembekileyo zokufikelela kwidatha eyimfihlo ngexesha lokuphunyezwa.
Kumaqela e-DevOps, oku kuthetha ukuqonda indlela esebenza ngayo i-runtime. Kubaphathi bezokhuseleko, kuthetha ukunciphisa ukuvezwa ngokukhawuleza nangokufanelekileyo.
Kuba kwiimeko zanamhlanje, umngcipheko omkhulu asikuko oko kwenziwayo.
Yiyo le ifikelelwayo xa sele isebenza.
