[B! Security][MongoDB] raimon49ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

raimon49 id:raimon49

Securityã¨MongoDBã«é–¢ã™ã‚‹raimon49ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

ã€ŒMongoDBã€ç‹™ã†ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢æ”»æ’ƒã§2ä¸‡7000è¶…ã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ãŒè¢«å®³ã«--ç ”ç©¶è€…ã‚‰å ±å‘Š
å°åˆ·ã™ã‚‹ ãƒ¡ãƒ¼ãƒ«ã§é€ã‚‹ ãƒ†ã‚ã‚¹ãƒˆ HTML é›»åæ›¸ç± PDF ãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ ãƒ†ã‚ã‚¹ãƒˆ é›»åæ›¸ç± PDF ã‚¯ãƒªãƒƒãƒ—ã—ãŸè¨˜äº‹ã‚’Myãƒšãƒ¼ã‚¸ã‹ã‚‰èªã‚€ã“ã¨ãŒã§ãã¾ã™ è²§å¼±ãªè¨å®šã®ã¾ã¾ã§é‹ç”¨ã•ã‚Œã¦ã„ã‚‹ã€ŒMongo DBã€ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã«ä¾µå…¥ã—ã€ãƒ‡ãƒ¼ã‚¿ã‚’æ¶ˆåŽ»ã—ãŸã†ãˆã§ã€å¾©å…ƒæ–™ã¨ã—ã¦æœ€é«˜1ãƒ“ãƒƒãƒˆã‚³ã‚¤ãƒ³ã‚’è¦æ±‚ã™ã‚‹æ”»æ’ƒãŒç›¸æ¬¡ã„ã§ã„ã‚‹ã€‚ãã®æ•°ã¯ã“ã“1é€±é–“ã§æ•°ä¸‡ã«åŠã‚“ã§ã„ã‚‹ã¨ã„ã†ã€‚ ã‚ªãƒ©ãƒ³ãƒ€ã«æ‹ ç‚¹ã‚’ç½®ãGDI Foundationã®å…±åŒå‰µè¨è€…ã§ã‚ã‚‹Victor Geversæ°ã¨ã€ãƒŽãƒ«ã‚¦ã‚§ãƒ¼ã«æ‹ ç‚¹ã‚’ç½®ãé–‹ç™ºè€…ã®Niall Merriganæ°ã¯ã€Mongo DBã«å¯¾ã™ã‚‹æ”»æ’ƒã®æ€¥å¢—ã‚’è¿½è·¡ã—ã¦ãã¦ã„ã‚‹ã€‚ã“ã®æ”»æ’ƒã¯ã€è¤‡æ•°ã®ã‚°ãƒ«ãƒ¼ãƒ—ã«ã‚ˆã£ã¦å®Ÿè¡Œã•ã‚Œã¦ãŠã‚Šã€æ¨™çš„ã¨ãªã‚‹ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã®å†…å®¹ã‚’æ¶ˆåŽ»ã—ã€ã€ŒWARNINGã€ï¼ˆè¦å‘Šï¼‰ã‚„ã€ŒPWNEDã€ï¼ˆåˆ¶åœ§æ¸ˆã¿ï¼‰ã€ã€ŒPLEASE_READã€ï¼ˆå¿…èªï¼‰ã¨ã„ã£ãŸåç§°ã®ç©ºã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ã§ç½®ãæ›ãˆã‚‹ã¨ã„ã†ã‚‚
raimon49 2017/01/25
Bitcoin

DB

MongoDB

Security
ãƒªãƒ³ã‚¯
SanrioTownã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹éœ²å‡ºã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
2015å¹´12æœˆ19æ—¥ã€CSO Onlineã§å–ã‚Šä¸Šã’ã‚‰ã‚ŒãŸSanrioTownã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ãŒéœ²å‡ºã—ã¦ã„ãŸå•é¡Œã«ã¤ã„ã¦ã“ã“ã§ã¯é–¢é€£æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ å…¬å¼ç™ºè¡¨ 2015å¹´12æœˆ22æ—¥ Security Advisory: Corrected a vulnerability involving personal information of SanrioTown.com members SanrioTownã¨ã¯ä½•ã‹ æ¬¡ã®URLã‚ˆã‚Šã‚¢ã‚¯ã‚»ã‚¹ã§ãã‚‹Webã‚µã‚¤ãƒˆã‚ˆã‚Šã‚µãƒ¼ãƒ“ã‚¹ãŒæä¾›ã•ã‚Œã¦ã„ã‚‹ã€‚ http://www.sanriotown.com/ å…¬å¼ã®Facebookãƒšãƒ¼ã‚¸ã®èª¬æ˜Žã«ã‚ˆã‚Œã°ã€2002å¹´ã‚ˆã‚Šã‚µãƒ¼ãƒ“ã‚¹ãŒæä¾›ã•ã‚Œã¦ã„ã‚‹ä¸»ã«æµ·å¤–ã®ã‚µãƒ³ãƒªã‚ªãƒ•ã‚¡ãƒ³å‘ã‘ã®ã‚½ãƒ¼ã‚·ãƒ£ãƒ«ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚µãƒ¼ãƒ“ã‚¹ã€‚ã‚ªãƒ³ãƒ©ã‚¤ãƒ³ã‚²ãƒ¼ãƒ ã§ã‚ã‚‹Hello Kitty Online(SanrioTownä¸ã§ã¯HKOã¨ç•¥ã•ã‚Œã¦ã„ã‚‹)ã‚‚
raimon49 2015/12/24
MongoDB

Security

privacy

é‹ç”¨
ãƒªãƒ³ã‚¯
uu59ã®ãƒ¡ãƒ¢ | MongoDBã§ã‚‚SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã§ãã‚‹
ã‚¿ã‚¤ãƒˆãƒ«ã¯ã‚ã‹ã‚Šã‚„ã™ã•é‡è¦–ã§ã¤ã‘ãŸã®ã§ãã‚ŒSQLã˜ã‚ƒãªã„ã‚ˆã¨ã„ã†ã®ã¯æ‰¿çŸ¥ã®ä¸Šã§ã™ã€‚ Attacking NoSQL and Node.js: Server-Side JavaScript Injection (SSJS) SSJS whitepaper(PDF) JSONã‚’evalã§ä½œã‚‹ã‚ˆã†ãªã®ã¯è«–å¤–ã¨ã—ã¦ã€NoSQL Injectionã£ã¦é …ç›®ãŒé¢ç™½ã‹ã£ãŸã®ã§ãƒ¡ãƒ¢ã€‚ ã¾ãšMongo DBã«ã¯find()ã£ã¦ã„ã†ã®ãŒã‚ã‚‹ã‚“ã§ã™ãŒã€ä¸€èˆ¬çš„ã«ã¯db.find({x: 42})ã®ã‚ˆã†ã«ã‚ªãƒ–ã‚¸ã‚§ã‚¯ãƒˆã‚’æ¸¡ã—ã¦xãƒ—ãƒãƒ‘ãƒ†ã‚£ãŒ42ã®ãƒ¬ã‚³ãƒ¼ãƒ‰ã‚’å–å¾—ã™ã‚‹ã€ã¨ã„ã£ãŸç”¨é€”ã«ä½¿ã„ã¾ã™ã€‚ãŒã€db.find("this.x == 42")ã®ã‚ˆã†ã«æ–‡å—åˆ—ã‚’æ¸¡ã—ã¦ã‚‚åŒã˜çµæžœãŒè¿”ã£ã¦ãã¾ã™ã€‚ã“ã‚Œã¯MongoãŒå—ã‘å–ã£ãŸæ–‡å—åˆ—ã‚’evalã—ã¦ã‚‹ã›ã„ã§ã™ã€‚è©¦ã—ã«mongoã‚³ãƒ³ã‚½ãƒ¼ãƒ«ã§db.find("while(1){};retu
raimon49 2011/12/24
ãƒ‰ãƒ©ã‚¤ãƒã®å®Ÿè£…ã«ã‚ˆã£ã¦ã¯evalã‹ã‚‰æ³¨å…¥å¯èƒ½

MongoDB

Security
ãƒªãƒ³ã‚¯
1

ãŠçŸ¥ã‚‰ã›

ã‚‚ã£ã¨èªã‚€

å…¬å¼Twitter

@hatebu
æœ€æ–°ã®äººæ°—ã‚¨ãƒ³ãƒˆãƒªãƒ¼ã®é…ä¿¡

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

jæ¬¡ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

kå‰ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

lã‚ã¨ã§èªã‚€

eã‚³ãƒ¡ãƒ³ãƒˆä¸€è¦§ã‚’é–‹ã

oãƒšãƒ¼ã‚¸ã‚’é–‹ã

è¨å®šã‚’å¤‰æ›´ã—ã¾ã—ãŸx

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (4)

Securityã¨MongoDBã«é–¢ã™ã‚‹raimon49ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬4é€±ï¼‰

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ä¸€éƒ¨æ©Ÿèƒ½ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã«é–¢ã™ã‚‹ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬3é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

ã‚¿ã‚°

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (4)

Securityã¨MongoDBã«é–¢ã™ã‚‹raimon49ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

ã€ŒMongoDBã€ç‹™ã†ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢æ”»æ’ƒã§2ä¸‡7000è¶…ã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ãŒè¢«å®³ã«--ç ”ç©¶è€…ã‚‰å ±å‘Š

SanrioTownã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹éœ²å‡ºã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog

uu59ã®ãƒ¡ãƒ¢ | MongoDBã§ã‚‚SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã§ãã‚‹

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬4é€±ï¼‰

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ä¸€éƒ¨æ©Ÿèƒ½ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã«é–¢ã™ã‚‹ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚­ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬3é€±ï¼‰

å…¬å¼Twitter

ã‚­ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹

é–¢é€£ã‚¿ã‚°ã§çµžã‚Šè¾¼ã‚€ (4)

Securityã¨MongoDBã«é–¢ã™ã‚‹raimon49ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (3)

ã€ŒMongoDBã€ç‹™ã†ãƒ©ãƒ³ã‚µãƒ ã‚¦ã‚§ã‚¢æ”»æ’ƒã§2ä¸‡7000è¶…ã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹ãŒè¢«å®³ã«--ç ”ç©¶è€…ã‚‰å ±å‘Š

SanrioTownã®ãƒ‡ãƒ¼ã‚¿ãƒ™ãƒ¼ã‚¹éœ²å‡ºã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog

uu59ã®ãƒ¡ãƒ¢ | MongoDBã§ã‚‚SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã§ãã‚‹

ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬4é€±ï¼‰

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ä¸€éƒ¨æ©Ÿèƒ½ã®ãƒ¡ãƒ³ãƒ†ãƒŠãƒ³ã‚¹ã«é–¢ã™ã‚‹ãŠçŸ¥ã‚‰ã›

ä»Šé€±ã®ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯æ•°ãƒ©ãƒ³ã‚ãƒ³ã‚°ï¼ˆ2025å¹´11æœˆç¬¬3é€±ï¼‰

å…¬å¼Twitter

ã‚ãƒ¼ãƒœãƒ¼ãƒ‰ã‚·ãƒ§ãƒ¼ãƒˆã‚«ãƒƒãƒˆä¸€è¦§

ã¯ã¦ãªãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

å…¬å¼Twitter

ã¯ã¦ãªã®ã‚µãƒ¼ãƒ“ã‚¹