在此次红队演习中，我们还发现了一个允许未认证远程代码执行的漏洞，该漏洞存在于Brotli，一种广泛部署的压缩库，该库包含在许多软件中，如Node.js、Bun和Envoy等。这个漏洞允许攻击者通过发送或回复恶意压缩数据来在受影响的系统上运行自己的代码，而无需创建用户账户。换句话说，一个接受压缩输入的未打补丁的服务器可以被恶意客户端接管，而一个接受压缩输入（例如，“curl --compressed”）的未打补丁的客户端可以被恶意服务器接管。这个问题的根源其实是在2月份的Brotli源代码中被修复的，但当时没有人知道这导致了安全漏洞，也没有最近一次Brotli的更新。由于Brotli被集成到其他软件中，因此任何使用该库的软件都需要更新，然后是该软件的用户。我们向 Brotli 和其他下游项目（如 Node.js）披露了该漏洞，这些项目已发布或正在发布安全更新，并且 Brotli 已发布了新的版本并发布了 CVE。
以下是补丁和缓解措施的详细信息：
https://patchtheplanet.org/brotli
以下是补丁和缓解措施的详细信息：
https://patchtheplanet.org/brotli
查看原文
原帖正文
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.More details on the patch and mitigations below:
https://patchtheplanet.org/brotli
https://patchtheplanet.org/brotli
引用自 X
原帖地址：https://x.com/i/status/2113766354386084338
原帖：
0 条评论
登录后可以参与讨论。
成员登录还没有评论。第一条认真回应会很重要。