TL; DR
I-axios npm compromise ikhombisa indlela ukuhlaselwa kwe-supply chain yesimanje sebenzisa ukuncika okuthembekile ukuze ufinyelele idatha ebucayi ngesikhathi sokusebenza. Lesi sigameko sihlaziywe ngabacwaningi abaningi bezokuphepha, okuhlanganisa nokuhlukaniswa okuningiliziwe okuvela ku- I-Unit42 ukumbozwa kwemboni okugqamisa amaphethini okunikeza izimfanelo ahlobene nomsebenzi wesizwe.
Lesi sigameko sithinta:
- Amaqembu e-DevOps ayasebenza CI/CD pipelines ngokuqinisekiswa okusekelwe emvelweni
- Izinsizakalo ze-Backend ezisingatha izicelo ze-API eziqinisekisiwe
- Izinhlelo zokusebenza ezisebenzisa ama-axios okuxhumana kwe-HTTP kwangaphakathi nangaphandle
Ngenxa yokuthi ama-axios ahlala kungqimba yesicelo, inguqulo esengozini ingafinyelela:
- Izihloko zokugunyazwa kanye Amathokheni e-API
- Izinguquko kanye nezimfihlo zemvelo
- Ukuxhumana kwesevisi yangaphakathi
Umthelela wangempela awukona ukuthembela ngokwako, kodwa yilokho okungakufinyelela uma sekuqediwe.
Izenzo ezisheshayo:
- Khiya izinguqulo zokuthembela bese ubuyekeza izibuyekezo zakamuva
- Zungezisa okhiye be-API, amathokheni, kanye CI/CD iziqinisekiso
- Gada izicelo eziphumayo kanye nomsebenzi wokuqinisekisa
- I-Audit pipelines yezimfihlo eziveziwe
Okwenzekile ku-Axios npm Attack
Isigameko se-axios silandela iphethini ekhulayo ekuhlaselweni kwe-supply chain, lapho abahlaseli behlasela khona ukuncika okusetshenziswa kabanzi esikhundleni sobuthakathaka besicelo.
Ngokubeka engcupheni iphakheji ethembekile, abahlaseli bathola ukubulawa ngaphakathi kwezinkulungwane zezindawo ngasikhathi sinye.
Ngenxa yokuthi i-axios ingenye yamaklayenti e-HTTP asetshenziswa kakhulu ohlelweni lwe-JavaScript, ihlanganiswe ngokujulile ku:
- Izinsizakalo ze-Backend
- Izinhlelo zokusebenza zangaphambili
- CI/CD pipelines
Lokhu kwenza kube yithagethi enenani eliphezulu.
Uma inguqulo enonya isifakiwe futhi isetshenziswa, ithola izimvume ezifanayo nezohlelo lokusebenza oluyingenisile. Lokho kufaka phakathi ukufinyelela kuthrafikhi yenethiwekhi, iziqinisekiso, kanye nezinsizakalo zangaphakathi.
Lokhu kuvumelana kwathola ukunakwa okubanzi ngale komphakathi wezokuphepha, ngemibiko efana ne-Axios Ukuhlanganisa
ekhomba ukuxhumana okungenzeka nabasongeli abathuthukile kanye nemikhankaso ehlelekile.
Lokho Okwenziwa Yi-Axios Attack Ngempela Ngesikhathi Sokugijima
Isihluthulelo sokuqonda lokhu kuhlasela ukugxila ekuziphatheni kwesikhathi sokusebenza.
I-Axios isebenza ku-HTTP layer, okusho ukuthi iphatha izicelo eziphumayo. Lokhu kuyinika ukubonakala okuqondile kudatha ebucayi egeleza kuhlelo lokusebenza.
Inguqulo esengozini ingenza lokhu:
- Vimbela izicelo eziphumayo ngaphambi kokuba zithunyelwe
- Capture
Authorizationizihloko namathokheni e-API - Finyelela izinguquko zemvelo nge
process.env - Qaphela ukuxhumana phakathi kwezinsizakalo zangaphakathi
Isibonelo, i-interceptor enonya ingakhipha izihloko zokuqinisekisa bese izithumela buthule endaweni yangaphandle.
Ngesikhathi esifanayo, ukufinyelela eziguquguqukayo zemvelo kuvumela abahlaseli ukuthi bathole iziqinisekiso ngaphandle kokushintsha indlela yohlelo lokusebenza.
Ngaphandle, konke kuyaqhubeka nokusebenza njengoba bekulindelekile. Izicelo ziqedwa ngempumelelo, izinsizakalo ziphendula ngokujwayelekile, futhi pipelines azibonisi zimpawu zokwehluleka. Ngesikhathi esifanayo, idatha ebucayi ingase ivezwe kakade ngezindlela zokwenza ngemuva.
Ukugeleza Kokuhlasela Kwe-Axios: Kusukela Kuphakheji Eyenziwe Kabi Kuya Ekuvezweni Okuyimfihlo
1. Ukuyekethisa
Umhlaseli uthola ukulawula i-akhawunti yomgcini othembekile noma indlela yokukhululwa kwephakheji ngaphakathi kwe-axios ecosystem.
2. Ukusatshalaliswa
Izinguqulo ezinonya zishicilelwa ku-npm bese zidonswa emishinini yonjiniyela, CI/CD pipelines, kanye nokwakhiwa kohlelo lokusebenza ngezibuyekezo ezijwayelekile zokuncika.
3. Ukusebenza Kwesikhathi Sokusebenza
Umthwalo wokukhokha usebenza lapho ama-axios engeniswa futhi esetshenziswa, ezuza amalungelo afanayo esikhathi sokusebenza njengohlelo lokusebenza.
4. Ukufinyelela Okuyimfihlo
Ukuthembela okuphazamisekile kuthola ukubonakala kuma-header, amathokheni, iziguquguquko zemvelo, kanye nokuxhumana kwangaphakathi kwe-HTTP.
5. Ukukhipha
Idatha ebucayi ithunyelwa buthule kwingqalasizinda elawulwa abahlaseli ngenkathi izicelo zokuqala ziqhubeka nokusebenza ngokujwayelekile.
Izinkomba Zokuvumelana (ama-IoC)
Ukuze kuhlolwe ukuchayeka okungenzeka, amaqembu kufanele aqale ngokubukeza izinkomba ezaziwayo ezihlobene nokwehluleka kwe-axios. Ithebula elingezansi lifingqa izimpawu ezifanele kakhulu kuwo wonke amaphakheji, umsebenzi wenethiwekhi, kanye nezinto zokwenziwa zomsingathi.
Indlela Yokuchaza Lawa Ma-IoC
Nakuba lezi zinkomba ziwusizo, akufanele ziphathwe njengesu eliphelele lokuthola.
Empeleni, ukuhlaselwa okunje akuvamile ukuthembela esignalini eyodwa engaguquki. Izizinda ziyashintsha, imithwalo yokukhokha iyashintsha, futhi ama-hashe aphelelwa yisikhathi ngokushesha. Okuhlala kufana nokuziphatha.
Isibonelo, izicelo ezingalindelekile zokuphuma ngesikhathi sokusetshenziswa kwe-HTTP evamile zingabonisa ukukhishwa kwedatha. Ngokufanayo, ukusetshenziswa kweziqinisekiso ezivumelekile ezimweni ezingavamile kuvame ukukhomba ukuthi izimfihlo sezivele zembulwe.
Ezingeni lomsingathi, ukuba khona kwezikripthi zesikhashana noma ama-binary kungasikisela umsebenzi wangemva kokuxhashazwa, ikakhulukazi uma kuhlanganiswa nokungafani kwenethiwekhi.
Ngamanye amazwi, ama-IoC akusiza ukuthi uqinisekise isigameko.
Kodwa-ke, ukuqonda ukuziphatha yikho okukuvumela ukuthi ukubone kusenesikhathi.
| Isigaba | inkomba | Yekuchumana |
|---|---|---|
| Iphakheji | axios@1.14.1 | i-shasum: 2553649f2322049666871cea80a5d0d6adc700ca |
| Iphakheji | axios@0.30.4 | i-shasum: d6f3f62fd3b9f5432f5782b62d8cfd5247d5ee71 |
| Ukuncika | plain-crypto-js@4.2.1 | i-shasum: 07d889e2dadce6f3910dcbc253317d28ca61c766 |
| Network | sfrclak[.]com | Isizinda somyalo nokulawula |
| Network | 142.11.206[.]73 | I-IP yengqalasizinda ehlobene |
| Network | http://sfrclak[.]com:8000/6202033 | Kubonwe indawo yokugcina yokuhlunga |
| macOS | /Library/Caches/com.apple.act.mond | I-SHA256: 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a |
| Windows | %PROGRAMDATA%\wt.exe | Izinto ezingenzeka zokuphikelela |
| Windows | %TEMP%\6202033.vbs | I-artifact yokwenza okusekelwe kusikripthi |
| Windows | %TEMP%\6202033.ps1 | Umthwalo we-PowerShell. SHA256: 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 |
| Linux | /tmp/ld.py | I-SHA256: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf |
Inothi lophenyo: Lawa ma-IoC ayindawo yokuqala ewusizo yokuzingela izinsongo. Kodwa-ke, abahlaseli bangazungeza izizinda, imithwalo ekhokhelwayo, kanye nezinto zobuciko ngokushesha. Ngaleso sizathu, amaqembu kufanele ahlobanise lezi zinkomba nezimpawu zokuziphatha ezifana nethrafikhi ye-HTTP ephumayo engalindelekile, ukufinyelela okungajwayelekile ku- process.env, kanye nezibuyekezo ezingavamile zokuthembela.
Isibonelo: Indlela i-Axios npm Dependency eyekethisiwe engakhipha ngayo idatha
Ukuze uqonde ukuthi lokhu kuhlasela kwe-Axios npm kusebenza kanjani ngokoqobo, cabanga ngesibonelo esilula.
I-Axios ivumela onjiniyela ukuthi bachaze ama-request interceptors. Lawa ma-interceptors asebenza ngokuzenzakalelayo ngaphambi kwesicelo ngasinye se-HTTP.
Inguqulo enonya ye-axios ingasebenzisa kabi le ndlela:
Kungani Ukuhlasela kwe-Axios npm Kuyingozi
Uma uqala ukubona, akukho okubonakala kungahambi kahle. Isicelo siphunyeleliswa ngempumelelo, isicelo sisebenza njengoba bekulindelekile, futhi pipelines ziyaqhubeka zidlula ngaphandle kwamaphutha.
Kodwa-ke, imininingwane ebalulekile yenzeka ngaphambi kokuba isicelo sithunyelwe. Phakathi nalelo windi lokuqalisa, ukuncika okuphazamisekile kungafinyelela buthule futhi kuqoqe idatha ebucayi njengezihloko zokugunyazwa, amathokheni e-API, imethadatha yesicelo, kanye neziguquguquko zemvelo.
Ngenxa yokuthi le logic isebenza ngaphakathi komtapo wolwazi othembekile ohlala ngqo endleleni yesicelo se-HTTP, isebenza ngempumelelo ngamalungelo afanayo nohlelo lokusebenza ngokwalo. Ngenxa yalokho, ingafinyelela idatha evame ukuvikelwa kubahlaseli bangaphandle.
Okwenza lokhu kube yingozi kakhulu akukhona nje ukufinyelela kwedatha, kodwa nokuntuleka komthelela obonakalayo. Akukho ukuphazamiseka kokusebenza, akukho zicelo ezihlulekile, futhi akukho sibonakaliso esisheshayo sokuthi kukhona okungahambi kahle. Ngokombono wokusebenza, konke kuyaqhubeka nokusebenza njengoba bekulindelekile.
Okwamanje, ulwazi olubucayi kungenzeka ukuthi seluvele luphuma ohlelweni ngokuxhumeka okuphumayo okuhlangana nethrafikhi evamile yohlelo lokusebenza.
Kungani Lokhu Kuyinkinga Ye-DevOps Kuqala
Kumaqembu e-DevOps, lolu hlobo lokuhlasela kunzima kakhulu ukulubona ngoba luhlangana kalula nemisebenzi ekhona kakade.
Izinto ezixhomeke kuzo zifakwa ngokuzenzakalelayo, pipelines yenza ngendlela evamile, futhi akukho ukwehluleka okusheshayo okwenzekayo.
Ngesikhathi esifanayo, CI/CD izindawo zivame ukuveza iziqinisekiso zenani eliphezulu, okuhlanganisa:
- Amathokheni omhlinzeki wefu
- Okhiye bokusethwa
- CI/CD izimfihlo zokuqinisekisa
Ukuthembela okusengozini okusebenza kulo mongo kungafinyelela lezo ziqinisekiso ngqo.
Lokhu kudala isimo lapho konke kubonakala kujwayelekile, kuyilapho idatha ebucayi ifinyelelwa ngemuva.
Ingozi Yangempela: Ukudalulwa Okuyimfihlo Esikalini
I-axios npm compromise iqokomisa ushintsho olubalulekile kumasu okuhlasela anamuhla.
Umgomo akusekhona ukuxhaphaza ubuthakathaka, kodwa ukufinyelela iziqinisekiso ezivumelekile.
Ngenxa yokuthi izinhlelo zesimanje zithembele ekuqinisekisweni okusekelwe emvelweni, ukuthembela okusebenza ngesikhathi sokusebenza kungafinyelela:
- Okhiye be-API
- Amathokheni esevisi
- Iziqinisekiso zamafu
Lezi ziqinisekiso akudingeki ziphulwe.
Kudingeka zisetshenziswe kuphela.
Lokhu kuvumela abahlaseli ukuthi bathuthe eceleni, bafinyelele izinsizakalo, futhi bakhiphe idatha besebenzisa ubuqiniso obusemthethweni.
Ngenxa yalokho, umthelela uncike ekutheni yiziphi izimfihlo ezidalulwayo, hhayi endleleni ukuhlaselwa okwenziwa ngayo.
Kungani Amathuluzi Okuphepha Endabuko Ephuthelwa Lokhu
Izindlela zendabuko ziyahluleka ukubona lokhu kuhlaselwa ngoba zigxila ebuthakathakeni obaziwayo noma izimpawu ezingaguquki. Kodwa-ke, njengoba kuqokonyiswe ku- Ukuhlaziywa kwe-OpenAI Ngokuvumelana kwethuluzi lonjiniyela we-axios, ingozi yangempela ivela ngesikhathi sokusebenza, lapho ukuncika okuthembekile kuhlangana khona nedatha ebucayi.
Kodwa-ke, ukuthembela okuncishisiwe kungase kungabi nezinkomba ezisobala.
Kungase kube khona:
- Ayikho i-CVE
- Akukho siginesha enonya
- Akukho sakhiwo esingavamile
Ngesikhathi esifanayo, ukuhlaziywa okumile akuhlolisi ukuziphatha kwesikhathi sokusebenza. Akukwazi ukunquma ukuthi ukuncika kuxhumana kanjani nedatha ebucayi uma sekuqediwe.
Lokhu kudala igebe lapho ikhodi ibonakala iphephile ngesikhathi sokuhlaziywa kodwa iba yingozi ngesikhathi sokwenziwa.
Indlela Yokuthola Nokuvimbela Ukuhlaselwa Okufana Ne-Axios npm-Like
Ukuvimbela lolu hlobo lokuhlasela kwe-Axios npm kudinga ukushintsha kusuka ekuhlolweni okumile kuya ekuqaphelisweni kwesikhathi sokusebenza.
Amaqembu adinga ukubona ukuthi abantu abancintisanayo baziphatha kanjani, hhayi nje lokho abakuqukethe.
Lokhu kuhlanganisa:
- Ukuqapha ukufinyelela kwedatha ebucayi ngesikhathi sokusebenza
- Ukuthola izimfihlo ngaphambi kokuba zifike ezindaweni zokugcina izinto
- Iskena pipelineizinto zobuciko kanye nezimpawu zobufakazi eziveziwe
- Ukubheka umsebenzi wenethiwekhi ephumayo ukuze uthole okungavamile
Kodwa-ke, ukutholakala kuphela akwanele.
Kusukela Ekutholakaleni Kuya Ekuvimbeleni: Yini Eyehlisa Ingozi Ngempela
Ngemva kwesigameko esinjengalesi, amaqembu avame ukubhekana nenani elikhulu leziqinisekiso ezingase zivele obala.
Inselele akukhona ukuzithola. Kuwukuthola ukuthi yiziphi ezibalulekile.
Umbuzo oyinhloko uba:
Yiziphi izimfihlo ezisasebenza futhi ezingase zisetshenziswe?
Ngaphandle kokuqinisekiswa, amaqembu achitha isikhathi ethola iziqinisekiso ezingasebenzi kuyilapho izingozi zangempela zihlala zivulekile.
Impendulo ephumelelayo idinga:
- Ukuthola izimfihlo eziveziwe
- Ukuqinisekisa ukuthi basanikeza ukufinyelela
- Ukuzihoxisa noma ukuzishintshanisa ngokushesha
Lokhu kunciphisa isikhathi sokuchayeka futhi kunciphisa ifasitela lomhlaseli.
Indlela i-Xygeni Esiza Ngayo Ukunciphisa Ingozi Yokuhlinzekwa Kwempahla
I-Xygeni ibhekana nale nselele ngokuhlanganisa ukutholwa, ukuqinisekiswa, kanye nokulungiswa kube yindlela eyodwa yokusebenza.
Ihlala ikhomba izimfihlo eziveziwe kuyo yonke ikhodi, pipelines, kanye nezinto zobuciko. Ngesikhathi esifanayo, kuqinisekisa ukuthi lezo ziqinisekiso zisasebenza yini endaweni ezungezile.
Lokhu kuvumela amaqembu ukuthi agxile kulokho abahlaseli abangakusebenzisa ngempela.
Uma izimfihlo ezisebenzayo sezitholiwe, imisebenzi yokulungisa ezenzakalelayo isiza ukunciphisa isikhathi sokuvezwa ngokuhoxiswa noma ukujikeleza okulawulwayo.
Ngenxa yalokho, impendulo iba ngokushesha, kusengaphambilicise, futhi kungaphazamisi kakhulu.
Isiphetho
I-axios npm compromise ibonisa indlela ukuhlaselwa kwe-supply chain okuguquka ngayo.
Abahlaseli abasadingi ukuphula izinhlelo. Bathembele ekuthembekeni okuthembekile ukuze bafinyelele idatha ebucayi ngesikhathi sokuqaliswa.
Kumaqembu e-DevOps, lokhu kusho ukuqonda ukuziphatha kwesikhathi sokusebenza. Kubaholi bezokuphepha, kusho ukunciphisa ukuvezwa ngokushesha nangendlela ephumelelayo.
Ngoba ezindaweni zanamuhla, ingozi enkulu akuyona into eyenzeka.
Yilokho okufinyelelwayo uma sekuqalile.
