در معرض حملات سایبری قرار گرفتن بیش از ۲ میلیون سایت توسط یک آسیبپذیری جدید در افزونه محبوب وردپرس
?? ????? ??????? ?????? ???? ???? ????? ?? ??????? ?????? Advanced Custom Fields ???? ?????? ?????? ??? ??? ?? ???? ????? ?? ?? ?? ??? ?? ??? ?????? ?????? ????.
??? ???? ?? ?? ????? CVE-2023-30777 ?????? ???? ??? ???? ????? ?? ?? cross-site scripting ?? XSS ????????? ??? ?? ???????? ???? ????? ??????????? ?????? ?????? ?? ???????????? ?? ?? ??? ??? ???? ?????? ?????? ???? ?????????? ???? ????.
??? ?????? ?? ?? ??????? ?????? ? ?? ???? ??????? ?? ????? ???? ??? ?? ?? ?????? ??? ????[?] ????. ??? ???? ?? ? ?? ???? ??? ? ?? ??????? ????? ??.
Rafie Muhammad? ???? Patchstack? ?????????? ???[?]: «??? ?????????? ?? ?? ????? ????? ???? ????? ?????? ?? ??????? ???? ?? ?? ???? ???? ?? ?? ??? ????? ?? ???? ???? ?? ????? ????? ???? ?????? ?? ???? URL ?????????? ?????? ??? ?? ?? ???? ?????? ?????? ???».
????? XSS ?????????[?] ??????? ????? ????? ???????? ?? ???????? ???? ???? ??????? ?? ??? ?? ????? ???? ????????? ?? ???? ????? ?? ???? ????? ???? ???? ? ???? ?????? ?? ???? ?? ??????? ????????? ????? ???? ?? ???? ?? ?? ?????? ????? ????? ??????.
??? ???? ?????? ??????? ?? ??? ???? ??? ?? XSS ????????? ????????? ????? XSS ????????? ?????? ? ????? ?????? ? ?????? ????? ?? ????? ?????? ?? ????? ???? ?? ?? ?? ????? ??? ???????? ????? ????.
Imperva ???????? ??????[?]: «?? ???? XSS ????????? ??????? ????? ??????????? ??????? ??? ?? ????????? ???? ???????? ????????? ?? ????? ???????? ????????? ?? ?????? ?? ? ????????? ??????????? ???? ?? ????? ??????.»
????????? ??? ?? CVE-2023-30777 ?? ??????? ?? ??? ?? ???????? ??????? ??????? ?????? ??????? ???? ???? ????? ??? ??? ??? ?? ???? ??????? ??????? ? ?????? ?? ?????? ?????????? ???.
??? ????? ????? ????? ?? ?? Craft CMS ?? ??? XSS ?? ??? ????? (CVE-2023-30177 ? CVE-2023-31144) ?? ????? ??? ?? ????????? ???? ?? ???? ????? ???? ????? ?????? ???? ???? ??????????? ???? ????.
?????? ?? ????? ????? ?? ??? XSS ???? ?? ????? cPanel (CVE-2023-29489? ?????? ?/? ?? ????? CVSS) ??? ?? ???????? ???? ???????? ????? ???? ???? ????? ???? ??????? ?????? ???? ??????????? ???? ????.
Shubham Shah ?? Assetnote ?????????? ???[?]: “?? ????? ??????? ???????? ?? ???????? ?????? cPanel ???? ?? ??????????? ?? ?? ???? ?? ? ??? ?? ??? ???? ????? ??? ???? ??? ? ????? ??? ?? ???????? ?? ???? ????? ??? ???? cPanel ?? ????? ????? ?? ?? ???.”
????????? ?? ??? ?? ????? ???????? cPanel ????? ???????? ????? ?? ????? ?? ? ?? ??? ????? ????? ????? ??????? ???????? ???.
?????
[?] https://wordpress.org/plugins/advanced-custom-fields
[?] https://patchstack.com/articles/reflected-xss-in-advanced-custom-fields-plugins-affecting-2-million-sites
[?] https://owasp.org/www-community/attacks/xss
[?] https://www.imperva.com/learn/application-security/reflected-xss-attacks
[?] https://blog.assetnote.io/2023/04/26/cpanel-xss-advisory
[?] https://thehackernews.com/2023/05/new-vulnerability-in-popular-wordpress.html
???? : ???? ??? ??????? ????? ????????
