Zen

Translation

English type: Plain text
The original index file, the version 0 format, is an XML file generated as part of any repo. It is available at either _index.xml_ or the more recent signed version at _index.jar_. Recent versions of the client will always try _index-v1.jar_ first, which is a signed JSON format. If that is not available, the client will fallback to _index.jar_. _index.jar_ is also used for the "nearby" app swapping functionality. All of these _index.jar_ files must pass the signature verification before the XML is parsed.
219/5150 · 515

Sign in to save the translation.

English Chinese (Simplified) Actions
Threat level: Elevated
威胁等级：高
The application's XML parser implementation might be vulnerable to XML External Entity (XXE) attacks.
应用的 XML 解析器实现可能容易受到 XML 外部实体 (XXE) 攻击。
Impact
影响
If the XML parser has no restrictions for external and internal entities, then this might lead to arbitrary file disclosures or server-side request forgery (SSRF) vulnerabilities when XML input is parsed.
如果 XML 解析器对外部和内部实体没有限制，那么在解析 XML 输入时，这可能会导致任意文件泄露或服务器端请求伪造 (SSRF) 漏洞。
Our Response
我们的回应
The original index file, the version 0 format, is an XML file generated as part of any repo. It is available at either _index.xml_ or the more recent signed version at _index.jar_. Recent versions of the client will always try _index-v1.jar_ first, which is a signed JSON format. If that is not available, the client will fallback to _index.jar_. _index.jar_ is also used for the "nearby" app swapping functionality. All of these _index.jar_ files must pass the signature verification before the XML is parsed.
原始索引文件，版本 0 格式，是作为任何存储库的一部分生成的 XML 文件。它可以在 _index.xml_ 或 _index.jar_ 的最新签名版本中获得。最新版本的客户端总是会首先尝试 _index-v1.jar_，这是一种签名的 JSON 格式。如果不可用，客户端将回退到 _index.jar_。 _index.jar_ 也用于“附近”应用交换功能。所有这些 _index.jar_ 文件都必须在解析 XML 之前通过签名验证。
Successful exploitation of this would require either a) the attacker was able to get the target to add a malicious repo, or b) the attacker was able to get the repo signing keys and then break into an existing repo's server and replace the index files. For example, a malicious actor could try to exploit someone via Nearby app swapping, so only get apps from people you trust. The way that the client is set up to parse the XML was vulnerable, and would allow a successful attacker to read files that the F-Droid app can read
成功利用它需要 a) 攻击者能够让目标添加恶意存储库，或者 b) 攻击者能够获得存储库签名密钥，然后闯入现有存储库的服务器并替换索引文件。例如，恶意行为者可能会尝试通过附近应用交换来攻击某人，因此只能从您信任的人那里获取应用。客户端设置为解析 XML 的方式很容易受到攻击，并且允许成功的攻击者读取 F-Droid 应用可以读取的文件
For f-droid.org and the Guardian Project repo, the index files are monitored, and changes to them are logged. So we can say with high confidence that _index-v1.jar_ was never removed, which is a prerequisite for exploiting this vulnerability.
对于 f-droid.org 和 Guardian Project 存储库，索引文件受到监控，并记录对它们的更改。因此我们可以非常肯定地说，_index-v1.jar_ 从未被删除，而这是利用此漏洞的先决条件。
F-Droid client v1.15.4 disables all support for XML External Entities. The v1.16-alpha0 no longer supports XML indexes at all, and all code related to the XML index parsing and generation was removed. We will also be working on improving the security of adding repos as part of the [FFDW-DVD]({% post_url 2022-02-05-decentralizing-distribution %}) funding.
F-Droid 客户端 v1.15.4 禁用了对 XML 外部实体的所有支持。v1.16-alpha0 完全移除了对 XML 索引的支持，所有与 XML 索引解析和生成相关的代码都被删除了。作为 [FFDW-DVD]({% post_url 2022-02-05-decentralizing-distribution %}) 资助的一部分，我们还将致力于提高添加存储库的安全性。
CLN-005 -- Vulnerable TLS versions accepted
CLN-005 -- 接受易受攻击的 TLS 版本
Vulnerability type: Insecure configuration
漏洞类型：不安全配置

Loading…

User avatar linsui

Translation added

  1. F-Droid
  2. Website Posts
  3. Chinese (Simplified)
The original index file, the version 0 format, is an XML file generated as part of any repo. It is available at either _index.xml_ or the more recent signed version at _index.jar_. Recent versions of the client will always try _index-v1.jar_ first, which is a signed JSON format. If that is not available, the client will fallback to _index.jar_. _index.jar_ is also used for the "nearby" app swapping functionality. All of these _index.jar_ files must pass the signature verification before the XML is parsed.
原始索引文件，版本 0 格式，是作为任何存储库的一部分生成的 XML 文件。它可以在 _index.xml_ 或 _index.jar_ 的最新签名版本中获得。最新版本的客户端总是会首先尝试 _index-v1.jar_，这是一种签名的 JSON 格式。如果不可用，客户端将回退到 _index.jar_。 _index.jar_ 也用于“附近”应用交换功能。所有这些 _index.jar_ 文件都必须在解析 XML 之前通过签名验证。
a year ago
User avatar None

String updated in the repository

  1. F-Droid
  2. Website Posts
  3. Chinese (Simplified)
The original index file, the version 0 format, is an XML file generated as part of any repo. It is available at either _index.xml_ or the more recent signed version at _index.jar_. Recent versions of the client will always try _index-v1.jar_ first, which is a signed JSON format. If that is not available, the client will fallback to _index.jar_. _index.jar_ is also used for the "nearby" app swapping functionality. All of these _index.jar_ files must pass the signature verification before the XML is parsed.
 
a year ago
Browse all string changes

Things to check

Consecutive duplicated words

Text contains the same word twice in a row: _index.jar_

Reset

Glossary

English Chinese (Simplified)
App 应用 F-Droid Glossary
client 客户端 F-Droid Glossary
index 索引 F-Droid Glossary
Nearby 附近 F-Droid Glossary
repo 存储库 F-Droid Glossary
Repo 存储库 F-Droid Glossary
version 版本 F-Droid Glossary

String information

Source string description
type: Plain text
Flags
md-text, safe-html
Source string location
_posts/2022-12-22-third-audit-results.md
String age
a year ago
Last updated
11 months ago
Source string age
a year ago
Translation file
po/_posts.zh_Hans.po, string 3375