2022年11月15日

新聞分享這篇文章提供的新的漏洞在Spotify的後台,發現一個CNCF孵化項目特拉維夫,以色列,11月15日2022 / EINPresswire.com——大眼睛,獲獎原生雲應用程序安全性的提供者,今天宣布一個關鍵的存在新的弱點在Spotify的後台項目中,要求開發人員立即采取行動在他們的環境中。通過利用一個VM沙箱vm2逃脫通過第三方庫,牛眼菊研究團隊獲得了能力在後台進行未經身份驗證的遠程代碼執行的項目。牛眼菊報道通過Spotify的bug賞金計劃,和Spotify迅速修補漏洞和後台發布1.5.1版本,修複這個問題。牛眼菊發表了詳細的博客上的漏洞。後台統一所有基礎設施工具、服務和文檔創建一個流線型的開發環境。在Github上有超過19000顆恒星,它是最受歡迎的開源平台構建開發者門戶網站和廣泛使用Spotify,美國航空公司,Netflix, Splunk,富達投資,史詩般的遊戲,帕洛阿爾托網絡和許多其他人。在後台接受了原生雲計算基礎(CNCF) 9月8日,2020年,在孵化項目成熟度級別。“利用vm2沙箱逃脫架子工核心插件,用於在默認情況下,未經身份驗證的威脅演員有能力執行任意係統命令在後台應用程序中,“尤奧斯特洛夫斯基說,軟件架構師的大眼睛。這樣的“關鍵原生雲應用程序漏洞越來越普遍,關鍵是這些問題及時得到解決。”“我們自旋向上的每一個研究項目始於潛在的輸入映射到應用程序。什麼引起了我們的注意,在這種情況下後台軟件模板和潛在的基於模板的攻擊,“牛眼菊的研究主管丹尼爾•亞伯說。 “In reviewing how to confine this risk, we noticed that the templating engine could be manipulated to run shell commands by using user-controlled templates with Nunjucks outside of an isolated environment.” Evaluating user-provided strings in a template engine can be dangerous since it exposes the application to such template-based attacks. The severity of an attack depends on the features the templating engine offers. In this case, the root of a template-based VM escape was able to gain JavaScript execution rights within the template. However, by using "logic-less" template engines such as Mustache, the introduction of server-side template injection vulnerabilities can be avoided. Separating the logic from the presentation as much as possible can greatly reduce exposure to the most dangerous template-based attacks. “If using a template engine in an application, make sure to choose the right one in relation to security. Robust template engines are extremely useful but might pose a risk to the organization,” said Gal Goldshtein, Senior Security Researcher at Oxeye. “If using Backstage, we strongly recommend updating it to the latest version to defend against this vulnerability as soon as possible.” Oxeye’s DevSecOps and AppSec solution is designed for cloud-native application security testing and risk analysis and is enriched with infrastructure layer configuration data. The Oxeye security research team leverages the context-based and multi-dimensional vulnerability analysis capabilities built into the platform to help clear the noise of false positives caused by legacy solutions, and prevent false negatives. This ensures that security teams can focus their resources on other concerns putting the organization at risk. If interested in learning more about how Oxeye can assist with cloud-native application security challenges, please visit https://www.oxeye.io/contact to contact us. Resources: ● Take a deeper dive into the vulnerability by reading the blog entry on Oxeye’s website at: https://www.oxeye.io/blog ● Follow Oxeye on Twitter at @OxeyeSecurity ● Follow Oxeye on LinkedIn at https://www.linkedin.com/company/oxeyeio/ ● Visit Oxeye online at http://www.oxeye.io About Oxeye Oxeye provides a cloud-native application security solution designed specifically for modern container and Kubernetes-based architectures. The company enables customers to quickly identify and resolve all application-layer risks as an integral part of the software development lifecycle by offering a seamless, comprehensive, and effective solution that ensures touchless assessment, focus on the exploitable risks, and actionable remediation guidance. Built for Dev and AppSec teams, Oxeye helps to shift security to the left while accelerating development cycles, reducing friction, and eliminating risks. To learn more, please visit www.oxeye.io . - END -