{"id":1300,"date":"2022-06-17T13:42:28","date_gmt":"2022-06-17T06:42:28","guid":{"rendered":"https:\/\/dt-corp.com.vn\/?p=1300"},"modified":"2022-06-17T13:42:28","modified_gmt":"2022-06-17T06:42:28","slug":"lo-hong-trong-api-cua-travis-ci-lam-lo-hang-nghin-access-token-cua-nguoi-dung","status":"publish","type":"post","link":"https:\/\/dt-corp.com.vn\/?p=1300","title":{"rendered":"L\u1ed7 h\u1ed5ng trong API c\u1ee7a Travis CI l\u00e0m l\u1ed9 h\u00e0ng ngh\u00ecn Access Token c\u1ee7a ng\u01b0\u1eddi d\u00f9ng"},"content":{"rendered":"

M\u1ed9t l\u1ed7 h\u1ed5ng an ninh ch\u01b0a \u0111\u01b0\u1ee3c kh\u1eafc ph\u1ee5c trong Travis CI API \u0111\u00e3 khi\u1ebfn cho h\u00e0ng ngh\u00ecn Access Token c\u1ee7a ng\u01b0\u1eddi d\u00f9ng tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau c\u1ee7a c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng ti\u1ec1m \u1ea9n. \u0110i\u1ec1u n\u00e0y cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng x\u00e2m ph\u1ea1m v\u00e0o c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng \u0111\u00e1m m\u00e2y, th\u1ef1c hi\u1ec7n thay \u0111\u1ed5i m\u00e3 x\u00e1c th\u1ef1c v\u00e0 b\u1eaft \u0111\u1ea7u c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng chu\u1ed7i cung \u1ee9ng.<\/b><\/p>\n

\"1655266849185.png\"<\/div>\n

“H\u01a1n 770 tri\u1ec7u log (nh\u1eadt k\u00fd) c\u1ee7a ng\u01b0\u1eddi d\u00f9ng b\u1ecb l\u1ed9 l\u1ecdt, t\u1eeb \u0111\u00f3 k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 d\u1ec5 d\u00e0ng tr\u00edch xu\u1ea5t Access Token, kh\u00f3a truy c\u1eadp ho\u1eb7c th\u00f4ng tin \u0111\u0103ng nh\u1eadp c\u1ee7a c\u00e1c n\u1ec1n t\u1ea3ng \u0111\u00e1m m\u00e2y kh\u00e1c \u0111\u01b0\u1ee3c li\u00ean k\u1ebft v\u1edbi t\u00e0i kho\u1ea3n nh\u01b0 GitHub, AWS hay Docker Hub”, c\u00e1c chuy\u00ean gia c\u1ee7a c\u00f4ng ty Aqua \u0111\u1ec1 c\u1eadp trong m\u1ed9t b\u00e1o c\u00e1o.<\/p>\n

Travis CI l\u00e0 m\u1ed9t d\u1ecbch v\u1ee5 t\u00edch h\u1ee3p li\u00ean t\u1ee5c \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 x\u00e2y d\u1ef1ng v\u00e0 ki\u1ec3m tra c\u00e1c d\u1ef1 \u00e1n ph\u1ea7n m\u1ec1m \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef tr\u00ean c\u00e1c n\u1ec1n t\u1ea3ng \u0111\u00e1m m\u00e2y nh\u01b0 GitHub v\u00e0 Bitbucket.<\/p>\n

L\u1ed7 h\u1ed5ng \u0111\u00e3 \u0111\u01b0\u1ee3c b\u00e1o c\u00e1o t\u1eeb n\u0103m 2015 v\u00e0 2019, b\u1eaft ngu\u1ed3n t\u1eeb th\u1ef1c t\u1ebf l\u00e0 API cho ph\u00e9p truy c\u1eadp v\u00e0o l\u1ecbch s\u1eed nh\u1eadt k\u00fd \u1edf d\u1ea1ng b\u1ea3n r\u00f5, t\u1eeb \u0111\u00f3 hacker c\u00f3 th\u1ec3 “t\u00ecm n\u1ea1p c\u00e1c nh\u1eadt k\u00fd m\u00e0 tr\u01b0\u1edbc \u0111\u00e2y kh\u00f4ng c\u00f3 s\u1eb5n th\u00f4ng qua API”.<\/p>\n

C\u00e1c b\u1ea3n ghi nh\u1eadt k\u00fd k\u1ec3 t\u1eeb th\u00e1ng 1 n\u0103m 2013 cho \u0111\u1ebfn th\u00e1ng 5 n\u0103m 2022, t\u00ednh t\u1eeb nh\u1eadt k\u00fd s\u1ed1 4.280.000 cho \u0111\u1ebfn 774.807.924, \u0111\u1ec1u c\u00f3 th\u1ec3 b\u1ecb truy xu\u1ea5t th\u00f4ng qua API.<\/p>\n

M\u1ed9t ph\u00e2n t\u00edch s\u00e2u h\u01a1n v\u1ec1 20.000 nh\u1eadt k\u00fd ti\u1ebft l\u1ed9 73.000 Access Token, kh\u00f3a truy c\u1eadp v\u00e0 th\u00f4ng tin \u0111\u0103ng nh\u1eadp c\u1ee7a c\u00e1c n\u1ec1n t\u1ea3ng \u0111\u00e1m m\u00e2y kh\u00e1c \u0111\u01b0\u1ee3c li\u00ean k\u1ebft v\u1edbi t\u00e0i kho\u1ea3n nh\u01b0 GitHub, AWS hay Docker Hub.<\/p>\n

\n
\"1655267006135.png\"<\/div>\n<\/div>\n

M\u1eb7c d\u00f9 Travis CI \u0111\u00e3 n\u1ed7 l\u1ef1c kh\u1eafc ph\u1ee5c v\u1ea5n \u0111\u1ec1 n\u00e0y b\u1eb1ng vi\u1ec7c gi\u1edbi h\u1ea1n t\u1ef7 l\u1ec7 API, t\u1ef1 \u0111\u1ed9ng \u1ea9n \u0111i c\u00e1c bi\u1ebfn m\u00f4i tr\u01b0\u1eddng v\u00e0 m\u00e3 th\u00f4ng b\u00e1o t\u1eeb nh\u1eadt k\u00fd b\u1eb1ng c\u00e1ch hi\u1ec3n th\u1ecb chu\u1ed7i “[secure]” \u1edf v\u1ecb tr\u00ed c\u1ee7a ch\u00fang, nh\u01b0ng l\u1ed7 h\u1ed5ng n\u00e0y v\u1eabn b\u1ecb khai th\u00e1c.<\/p>\n

M\u1ed9t trong nh\u1eefng chi ti\u1ebft quan tr\u1ecdng l\u00e0 m\u1eb7c d\u00f9 “github_token” \u0111\u00e3 \u0111\u01b0\u1ee3c \u1ea9n \u0111i, nh\u01b0ng 20 bi\u1ebfn th\u1ec3 kh\u00e1c c\u1ee7a token n\u00e0y v\u1eabn tu\u00e2n theo m\u1ed9t quy \u01b0\u1edbc \u0111\u1eb7t t\u00ean kh\u00e1c, bao g\u1ed3m github_secret, gh_token, github_api_key v\u00e0 github_secret, nh\u1eefng bi\u1ebfn th\u1ec3 n\u00e0y kh\u00f4ng b\u1ecb \u1ea9n \u0111i b\u1edfi Travis CI.<\/p>\n

C\u00e1c chuy\u00ean gia cho bi\u1ebft: “Travis CI l\u00e0m ch\u1eadm t\u1ed1c \u0111\u1ed9 c\u1ee7a c\u00e1c l\u1ec7nh g\u1ecdi API, \u0111i\u1ec1u n\u00e0y c\u1ea3n tr\u1edf kh\u1ea3 n\u0103ng truy v\u1ea5n API tr\u00e1i ph\u00e9p. Tuy nhi\u00ean, trong tr\u01b0\u1eddng h\u1ee3p n\u00e0y th\u00ec \u0111i\u1ec1u \u0111\u00f3 l\u00e0 ch\u01b0a \u0111\u1ee7. M\u1ed9t k\u1ebb t\u1ea5n c\u00f4ng l\u00e0nh ngh\u1ec1 c\u00f3 th\u1ec3 t\u00ecm ra c\u00e1ch gi\u1ea3i quy\u1ebft \u0111\u1ec3 qua m\u1eb7t v\u1ea5n \u0111\u1ec1 n\u00e0y.”<\/p>\n

“V\u1edbi m\u1ed9t h\u1ec7 th\u1ed1ng cho ph\u00e9p truy c\u1eadp nh\u1eadt k\u00fd th\u00f4ng qua API, ki\u1ec3m duy\u1ec7t kh\u00f4ng \u0111\u1ea7y \u0111\u1ee7 c\u00f9ng v\u1edbi m\u1ed9t s\u1ed1 l\u01b0\u1ee3ng l\u1edbn nh\u1eadt k\u00fd c\u00f3 kh\u1ea3 n\u0103ng b\u1ecb l\u1ed9, th\u00ec vi\u1ec7c \u1ea9n \u0111i c\u00e1c th\u00f4ng tin nh\u1ea1y c\u1ea3m v\u00e0 th\u1ef1c hi\u1ec7n m\u1ed9t quy tr\u00ecnh y\u1ebfu \u0111\u1ec3 gi\u1edbi h\u1ea1n t\u1ed1c \u0111\u1ed9 truy c\u1eadp API v\u1eabn d\u1eabn \u0111\u1ebfn nh\u1eefng t\u00ecnh hu\u1ed1ng nghi\u00eam tr\u1ecdng”.<\/p>\n

Travis CI cho bi\u1ebft v\u1ea5n \u0111\u1ec1 n\u00e0y l\u00e0 do kh\u00e2u thi\u1ebft k\u1ebf, y\u00eau c\u1ea7u ng\u01b0\u1eddi d\u00f9ng n\u00ean tu\u00e2n theo c\u00e1c h\u01b0\u1edbng d\u1eabn \u0111\u01b0\u1ee3c khuy\u1ebfn ngh\u1ecb \u0111\u1ec3 tr\u00e1nh r\u00f2 r\u1ec9 c\u00e1c th\u00f4ng tin nh\u1ea1y c\u1ea3m trong nh\u1eadt k\u00fd v\u00e0 \u0111\u1ecbnh k\u1ef3 thay \u0111\u1ed5i Access Token c\u0169ng nh\u01b0 kh\u00f3a truy c\u1eadp.<\/p>\n

Nh\u1eefng ph\u00e1t hi\u1ec7n n\u00e0y \u0111\u1eb7c bi\u1ec7t quan tr\u1ecdng sau chi\u1ebfn d\u1ecbch t\u1ea5n c\u00f4ng v\u00e0o th\u00e1ng 4 n\u0103m 2022 \u2013 cu\u1ed9c t\u1ea5n c\u00f4ng s\u1eed d\u1ee5ng token ng\u01b0\u1eddi d\u00f9ng OAuth \u0111\u01b0\u1ee3c c\u1ea5p cho Heroku v\u00e0 Travis CI \u0111\u1ec3 t\u0103ng c\u01b0\u1eddng quy\u1ec1n truy c\u1eadp v\u00e0o c\u01a1 s\u1edf h\u1ea1 t\u1ea7ng NPM v\u00e0 sao ch\u00e9p c\u00e1c kho l\u01b0u tr\u1eef c\u00e1 nh\u00e2n.<\/p>\n

Ngu\u1ed3n:\u00a0The Hacker News<\/a><\/b><\/p>\n","protected":false},"excerpt":{"rendered":"

M\u1ed9t l\u1ed7 h\u1ed5ng an ninh ch\u01b0a \u0111\u01b0\u1ee3c kh\u1eafc ph\u1ee5c trong Travis CI API \u0111\u00e3 khi\u1ebfn cho h\u00e0ng ngh\u00ecn Access Token c\u1ee7a ng\u01b0\u1eddi d\u00f9ng tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau c\u1ee7a c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng ti\u1ec1m","protected":false},"author":3,"featured_media":1301,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[13],"tags":[],"class_list":["post-1300","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/dt-corp.com.vn\/wp-content\/uploads\/2022\/06\/1655266849185.png","_links":{"self":[{"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/posts\/1300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1300"}],"version-history":[{"count":1,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/posts\/1300\/revisions"}],"predecessor-version":[{"id":1302,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/posts\/1300\/revisions\/1302"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=\/wp\/v2\/media\/1301"}],"wp:attachment":[{"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dt-corp.com.vn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}