{"id":17618,"date":"2021-10-23T13:58:57","date_gmt":"2021-10-23T11:58:57","guid":{"rendered":"http:\/\/blog.wenzlaff.de\/?p=17618"},"modified":"2023-08-20T14:55:21","modified_gmt":"2023-08-20T12:55:21","slug":"ua-parser-js-updates-garantieren-keine-sicherheit-und-installiert-krypto-miner-auch-auf-raspberry-pi-allow-a-remote-attacker-to-obtain-sensitive-information-or-take-control-of-the-system","status":"publish","type":"post","link":"http:\/\/blog.wenzlaff.de\/?p=17618","title":{"rendered":"ua-parser-js updates garantieren keine Sicherheit und installiert Krypto-Miner auch auf Raspberry Pi? &#8211; allow a remote attacker to obtain sensitive information or take control of the system."},"content":{"rendered":"<p>Massive Sicherheitsl\u00fccke in <a href=\"https:\/\/www.npmjs.com\/package\/ua-parser-js\" rel=\"noopener\" target=\"_blank\">UAParser<\/a>. Selbst das <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2021\/10\/22\/malware-discovered-popular-npm-package-ua-parser-js\" rel=\"noopener\" target=\"_blank\">CIA<\/a> gibt eine Warnung heraus.<br \/>\nMal in allen Verzeichnisen auf meinem Raspberry Pi gesucht mit:<\/p>\n<pre class=\"lang:default decode:true \" >grep --include=\\*.json -rnw \/ -e 'ua-parser'<\/pre>\n<p>Ergebnis:<!--more--><\/p>\n<pre class=\"lang:default decode:true \" >\r\n.\/twarztsuche\/node_modules\/stream-http\/package.json:43:    \"ua-parser-js\": \"^0.7.18\",\r\n.\/bpmn-js-example-react-properties-panel\/node_modules\/stream-http\/package.json:43:    \"ua-parser-js\": \"^0.7.18\",\r\n.\/my-futurama-characters\/node_modules\/stream-http\/package.json:43:    \"ua-parser-js\": \"^0.7.18\",\r\n<\/pre>\n<p>Betroffen ist die Version:<br \/>\n<img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/blog.wenzlaff.de\/wp-content\/uploads\/2021\/10\/wenzlaff.de-2021-10-23-um-15.25.44.png\" alt=\"\" width=\"260\" height=\"220\" class=\"aligncenter size-full wp-image-17625\" \/><\/p>\n<p>Wird auch in der <a href=\"https:\/\/www.npmjs.com\/package\/stream-http\">stream-http<\/a> Lib als transitive Abh\u00e4ngigkeit verwendet.<\/p>\n<p>Dann kann mein Rechner wie <a href=\"https:\/\/github.com\/advisories\/GHSA-pjwm-rvh2-c87w\" rel=\"noopener\" target=\"_blank\">hier<\/a> beschrieben ja nicht als kompromittiert gelten, da es in der Version noch nicht vorhanden war \ud83d\ude09 Gl\u00fcck gehabt. Aber bei den JavaScript Projekten mit ihren vielen Abh\u00e4ngigkeiten wohl nur eine Frage der Zeit. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Massive Sicherheitsl\u00fccke in UAParser. Selbst das CIA gibt eine Warnung heraus. Mal in allen Verzeichnisen auf meinem Raspberry Pi gesucht mit: grep &#8211;include=\\*.json -rnw \/ -e &#8218;ua-parser&#8216; Ergebnis:<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_import_markdown_pro_load_document_selector":0,"_import_markdown_pro_submit_text_textarea":"","footnotes":""},"categories":[220,1319],"tags":[5057,176,2544,5058,5059,5061,5060],"class_list":["post-17618","post","type-post","status-publish","format-standard","hentry","category-anleitung","category-sicherheit-2","tag-kompromittiert","tag-sicherheit","tag-sicherheitsluecke","tag-stream-http","tag-ua-paarsre","tag-ua-parsre-js","tag-uaparser"],"_links":{"self":[{"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=\/wp\/v2\/posts\/17618","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=17618"}],"version-history":[{"count":0,"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=\/wp\/v2\/posts\/17618\/revisions"}],"wp:attachment":[{"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17618"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17618"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.wenzlaff.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17618"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}