Sake rabawa — abun ciki daga Vincent Strubel
PHP2Shell: a kula da girgizar ƙasa bayan babbar
Wallafar da aka yi na rashin tsari na munanan raunuka a cikin PHP a makon da ya gabata ya haifar da gagarumin yunƙuri, a faɗin duniya, don gaggauta shafa facin a kan adadi mai yawa na shafukan yanar gizo. Muna iya yin murna da hakan.
Amma bai kamata mu yi saurin tunanin an warware matsalar ba: haɗarin yana ƙaura daga shafukan yanar gizo zuwa ɗimbin kayayyakin wasu kamfanoni waɗanda ke ɗauke da nau'ikan PHP (a cikin wata hanyar gudanarwa ta yanar gizo): na'urorin sadarwa, ganuwar wuta, masu sarrafa masana'antu, abubuwan da aka haɗa a ma'ana mai faɗi… Su ma dole ne a sabunta su.
Wata hanya mai amfani don guje wa nutsewa cikin sarƙaƙƙiyar batun: yunƙurin takwarorinmu 
a Cibiyar Tsaron Yanar Gizo ta Ƙasa (NCSC-NL), waɗanda ke tattara a cikin ajiyar github bayanan da ake da su kan sabuntawar kayayyakin da ke ɗauke da PHP.
Wannan yana ba mu damar haɗa ƙoƙarinmu aƙalla a matakin Turai, da kuma guje wa maimaita aiki ko bayanai. Bravo da godiya gare su! ANSSI yanzu yana ambaton wannan ajiya a cikin faɗakarwarsa, kuma yana shigar da nata bayanan cikin babban jagorar.
Ajiyar Github: https://lnkd.in/eXTxysrt
Majiyoyin LinkedIn
- Bayanan martaba: Pierre Jean Duvivier dit Sage (LinkedIn)
- Marubucin da aka raba: Vincent Strubel (LinkedIn)
Wallafar ⚠️ PHP2Shell: a kula da girgizar ƙasa bayan babbar ta fara bayyana a les plumes qui mordent.
Tambayoyin da ake yawan yi
FAQs PHP2Shell A kula da girgizar ƙasa bayan babbar
Q Menene PHP2Shell
A Suna ne na wani nau'in hari inda aibi a cikin lambar PHP ke ba mai hari damar gudanar da nasa umarnin a uwar garkenka sau da yawa kai tsaye bayan an gyara wani rauni mai alaƙa Girgizar ƙasa bayan babbar tana nufin hare-haren da ke biyo baya waɗanda ke faruwa kafin ko bayan an gyara na farko
Q Me ake nufi da girgizar ƙasa bayan babbar a nan
A Misali ne daga girgizar ƙasa Bayan wani amfani da rauni masu hari suna ci gaba da bincika ramukan da suka rage fayilolin da aka manta ko facin da ba su da ƙarfi Waɗannan hare-haren da ke biyo baya su ne girgizar ƙasa bayan babbar kuma suna iya yin illa daidai
Q Shin PHP2Shell takamaiman CVE ne ko ainihin samfur
A A'a Lakabi ne mai bayyanawa ba ID ɗin rauni ɗaya ba ko kayan aiki ba Ka ɗauke shi a matsayin tsarin gargaɗi aibi a PHP da ke kaiwa ga gudanar da shell tare da hare-haren da ke biyo baya
Q Ta yaya mai hari ke tafiya daga PHP zuwa shell
A Yawanci ta hanyar sarrafa shigarwar da ba ta da aminci misali miƙa shigarwar mai amfani ga system exec shellexec popen ko backticks ko ta hanyar ɗora fayiloli includerequire tare da hanyoyin da mai amfani ke sarrafawa ko matsalolin deserialization Da zarar lambar ta gudana za su iya haifar da shell
Q Me ya sa zan damu idan na riga na gyara babban aibin
A Domin girgizar ƙasa bayan babbar tana kaiwa ga abin da ka rasa kwafin da ba a gyara ba fayilolin ajiya wuraren gyara lambar da aka adana ko wasu ayyuka da ke raba irin waɗannan takardun shaidarka Facin da ya tsafta ba ya gyara barnar da aka riga aka yi
Q Menene alamun gargaɗi na gama gari na hari
A Haɗin waje da ba a zata ba sabbin fayiloli ko waɗanda aka canza a cikin manyan kundayen yanar gizo ayyukan cron baƙo masu amfani ko maɓallan SSH da ba a sani ba matakai da ba a saba ba da hauhawar rajistan kurakurai ko 500s
Q Ta yaya zan duba ko aikace-aikacena yana da rauni
A Bincika lambarka don ayyuka masu haɗari ka ga ko wani yana ɗaukar shigarwar mai amfani Hakanan duba ɗora fayiloli hanyoyin include da kiran unserialize Gudanar da kayan aikin nazari na tsaye da abin dogaro
