Mhla ti-5 Ingongoni 2026, bacwaningi base-Novee laholwa ngu-Lidor Ben Shitrit betfula umsebenti ku-Black Hat USA lowembula emaphutsa lalishumi nakubili kumaplatfomu lamane e-Java yemabhizinisi, lafaka emaketango lamabili lamakhulu lavumela kusebentisa ikhodi ku-server ngaphandle kwekungena nhlobo, kuplatfomu yekuhamba kwemsebenti i-Bonita BPM nase-Apache OFBiz, i-ERP ye-open source. Sifundvo lesisebentako kunoma ngubani lonebhizinisi: luhlelo lowucabanga kutsi luvikelekile ngobe lungelwangekhatsi lungafinyelelwa ngeticelo letimbili te-browser nangabe luvulekile futsi lungakalungiswa. Kuvikeleka kwangempela kucala ngeluhlu lwaloko lokusebentisako kanye nemkhuba wekufaka kulungiswa, hhayi ngekwetsemba umngcele wenethiwekhi.

Loko bacwaningi lebakutfola ngempela

Lolucwaningo belungakhiwanga ephutseni linye lelimangalisako. Lwakhiwe ngekuhlanganisa emaphutsa lamancane lavamile e-middleware: umehluko endleleni i-URL lehlukaniswa ngayo, kuvikela lokungakapheleli esigabeni lesiphatsa ticelo, tikhiye te-cryptography letibhalwe ngca ekhodini, kanye nekuhlola ema-template ngendlela lengaphephile. Ngalinye ngalinye kute kulawo lelibukeka liyingoti, futsi yiloko kanye lokwenta asinde ekubuyekeni kwekhodi abhalwe njengalanganakekeli lokukhulu. Uma ahlanganiswe ndzawonye akha indlela lephelele kusuka esivakashini lesingatiwa kuya ekusebentiseni imiyalo ku-server. Kulamaphutsa lalishumi nakubili, lamane asebenta ngaphambi kwekucinisekiswa futsi linye liphula kwehlukaniswa ngekhatsi kwe-sandbox yekusebentisa.

Liketango i-BadBonita: tindzawo letintsatfu letibutsakatsaka tenta kungenwa kunye lokuphelele

Liketango lekucala litsintsa i-Bonita BPM inguculo 10.4.3. Licala ngekweca kucinisekiswa lokwakhiwe ngebutsakatsaka lobutsatfu lobuhlobene: i-path traversal lesebentisa luphawu ..;, sihlungi sekuvikeleka lesifananisa incenye yemagama kunekuba sifananise yonkhe indlela, kanye nemcondvo wangekhatsi wekudlulisela ticelo. Umphumela kutsi sicelo sifinyelela ku-API yangekhatsi lokute muntfu wangaphandle lobekufanele ayibone. Leyo API yemukela i-XML lengetsenjwa futsi iyidlulisela ngca kulayibhrari i-XStream, leyenta i-deserialization yayo, futsi ngeliketango le-gadget le-Commons Collections leliyatiwa kakhulu indlela igcina ngemiyalo ye-Groovy lesebenta ku-server.

Naka kutsi kute nasinye salezinyatselo lesidzinga liphasiwedi levuthiwe, i-social engineering, noma kufinyelela kwangaphambilini. Konkhe lokudzingwa ngumhlaseli kutsi luhlelo lufinyeleleke ngenethiwekhi.

I-OFBiz: sikhiye sekusayina lesishicilelwe endzaweni yekugcina levulekile

Inkinga yesibili, lebhaliswe njenge-CVE-2026-31986 futsi yalinganiswa njengalenkhulu, itsintsa i-Apache OFBiz inguculo 24.09.05 nangabe i-single sign-on ivuliwe. Inkinga kutsi tikhiye tekusayina letisetiwe ekucaleni tihlala ekhodini yemtfombo leshicilelwe ebaleni, futsi ngobe tinyenti tinsiza leti letishiya tilungiselelo tekucala tingatsintfwanga, umhlaseli angakhohlisa ngekwakha i-token ye-SSO levumelekile ngelibito le-akhawunti yemphatsi. Kusuka lapho sicelo sendlula luhlu lwekwala lobeluzama kuvimba emagama lanjenge-java, process, ne-import, kodvwa luhlu belunaka bukhulu nebuncane betinhlamvu futsi luhlola tindlela letitsite, ngakoke kushintja bukhulu benhlamvu yinye noma kusebentisa lelinye libito le-class lelingeniswa ngekutentekela kwanele kutsi kwendlule. Umphumela wekugcina: ticelo letimbili te-GET letingakacinisekiswa tanele kufinyelela ekusebentiseni ikhodi kunoma ngukuphi kufakwa lokusebentisa i-SSO.

Kungani loku kubalulekile kuwe ngco

Ngobe kute kulokubili lokulithulusi lelingabalulekanga. I-OFBiz yi-ERP ye-open source letinkampani letinyenti letiyisebentisela kuphatsa sitoko, kutsenga, nema-invoyisi, kantsi i-Bonita yinjini yekuhamba kwemsebenti leshayela kuvunyelwa kwangekhatsi kanye netinchubo. Lofinyelela kuleti tindzawo letimbili akagcini ngekufundza idatha, ume emkhatsini wemjikelezo wakho wekusebenta: ema-oda ekutsenga, emanani ebahlinzeki, imininingwane yetisebenti, nemlandvo wemakhasimende. Bacwaningi babike kutsi bobabili labakhicitako bakhiphe tinguculo letilungisiwe ngekhatsi kwesikhatsi lesijwayelekile semalanga langemashumi layimfica sekwembula, loku kusho kutsi kubuyeketa kukhona futsi umtfwalo manje usekulowo losebentisa luhlelo, hhayi kulowo lolwakha.

Sikhala sangempela emakethe akusikho kungabi khona kwekulungiswa, kungabi khona kweluhlu. Tinhlangano letinyenti atinalo luhlu lwamuhla lwaloko letikusebentisa ngempela, ngakuyiphi inguculo, nakuyiphi i-domain. Ngakoke likhophi lendzala lekuhlola lihlala lilengiswe ku-subdomain lekhohlakele iminyaka lemibili libe ngumnyango lokute muntfu lowawucabanga.

Lokufanele ukwente kulelisontfo

  • Bhala luhlu lwemasistimu akho: luhlu lolubhaliwe lwalo lonkhe luhlelo lolusebentisako, inguculo yalo, kutsi luvulekile yini ku-inthanethi, nekutsi ngubani loluphetse ngelibito.
  • Buyeketa i-Bonita ne-OFBiz kutinguculo letilungisiwe ngekushesha nangabe usebentisa nome ngabe nguyiphi kuto, futsi ufundze likhasi lelisemtsetfweni lekuvikeleka le-Apache ngaphambi kwekutsi ukhuphule.
  • Shintja sonkhe sikhiye sekubetsela noma sekusayina lesisetiwe ekucaleni lesefike nemkhicito. Noma nguliphi linani lelibhalwe emiculweni yemiyalelo akusiyo imfihlo.
  • Vala emasango ekuphatsa ku-inthanethi levulekile futsi uwafinyelele ngenethiwekhi leyimfihlo noma ngeluhlu lolufushane lwemakheli lavunyelwe.
  • Susa emakhophi lamadzala ekuhlola nema-subdomain langasetjentiswa. Ayindzawo lelula kakhulu kuhlaselwa futsi lengabukwa kakhulu.
  • Vula kubhalwa kwekufinyelela futsi ukugcine. Ngaphandle kwemabhuku ekubhala ngeke ukhone kuphendvula ngemuva kutsi kukhona yini longenile nhlobo.

Sifundvo sebunjiniyela: inethiwekhi yangekhatsi akusiwo umngcele wekuvikeleka

Seluleko lesibaluleke kakhulu lesiphuma kulolucwaningo kutsi kuhanjiswa kwangekhatsi kufanele kuphatfwe ngetilawuli telizinga le-inthanethi. Umcondvo lomdzala wekutsi konkhe lokungemuva kwe-firewall kuphephile wehlulekile ngempela: liphutsa linye lekweca kucinisekiswa liphendvula yonkhe i-endpoint yangekhatsi ibe yemphakatsi. Kulandzela imitsetfo lemitsatfu yebunjiniyela, futsi ifanele ibe semazingeni akho ekwakha:

Ungalokotsi wetsembe luhlu lwekwala kuvikela umsebenti lonengoti. Nangabe kuhlolwa kwema-expression akudzingeki endleleni yekhodi, kususe ngalokuphelele esikhundleni sekutama kukuhlunga.

Umtsetfo wesibili kutsi ungalokotsi wenta umsebenti lobucayi uncike kufulegi yetilungiselelo noma kulokukhetfwa ngumsebenti lokungashintjwa ngekhatsi kweluhlelo. Lowesitsatfu kuhlola umcondvo wetihlungi tekucinisekisa nome ngabe nguyiphi indlela yekufananisa incenye yemagama, ngobe liphutsa lelivame kakhulu futsi lelisetjentiswa kalula kakhulu kulesigaba. Nasakha emasistimu lamasha ebhizinisi e-Origami sikusebentisa loku njengenchubo yetfu: imvume lecacile kuyo yonkhe i-endpoint, futsi kute kwetsemba lokususelwa kutsi sicelo sikuphi enethiwekhi.

Luhlangotsi lwemitsetfo eSaudi Arabia

Nangabe luhlelo lolungenwe luphetse idatha yemuntfu yalabo labaseMbusweni, loku kuyekela kuba yindzaba yebuchwepheshe kuphela. Umtsetfo Wekuvikela Imininingwane Yemuntfu (PDPL) uphoca umlawuli kutsi atsatse tinyatselo letidzingekile kuvikela leyo datha nekubika tehlakalo letitsintsa imfihlo yayo. Siphatsimandla Savelonkhe Sekuvikeleka kwe-Cyber (NCA) sishicilela tilawuli letisisekelo letifaka kuphatsa emaphutsa ekuvikeleka, kufaka kulungiswa, nekuphatsa imphahla, futsi tiyo kanye tilawuli lebetitawuvimba leliketango. Kusebentisa inguculo lendzala yemkhicito lenephutsa leliyatiwa lelase lilungisiwe kusimo lokulukhuni kusivikela kunoma nguluphi luhlolo.

Umtsetfo lolula: phatsa kubuyeketa kwekuvikeleka njengesibopho sekusebenta senyanga nenyanga lesinemnikati nelusuku, hhayi njengemsebenti lophutfumako lowentiwa ngemuva kwesehlakalo.

Imitfombo

  • Help Net Security — imininingwane ngemaketango e-RCE langaphambi kwekucinisekiswa ne-CVE-2026-31986: helpnetsecurity.com
  • Likhasi lelisemtsetfweni lekuvikeleka le-Apache OFBiz: ofbiz.apache.org/security.html
  • Siphatsimandla Savelonkhe Sekuvikeleka kwe-Cyber (NCA) — tilawuli netinhlaka temitsetfo: nca.gov.sa
  • Ligunya laseSaudi Ledatha Nebukhaliphi Lobentiwe (SDAIA) — Umtsetfo Wekuvikela Imininingwane Yemuntfu (PDPL): sdaia.gov.sa