CEMI

Transcript

1. CEMI 2023/11/27
2. ໨࣍ Contents 01ɹձࣾ֓ཁ 02ɹࣗݾ঺հ 03ɹCEMI
3.  ձࣾ֓ཁ about Asobica
10.  ࣗݾ঺հ profile
11. ໊લ ੢Ԭ ৻࢘ ໾ׂ WEBΞϓϦ։ൃΤϯδχΞ ॅ·͍ ฌݿݝ ௚ۙͷܦྺ հޢࣄۀऀ޲͚ࢧԉαʔϏε։ൃɺϕϏʔγολʔͷϚονϯά αʔϏε։ൃΛܦݧ͠ɺࠓ೥ͷ3݄ʹAsobicaೖࣾ ࣗݾ঺հ Profile Ո଒ ࠺ɺ௕உʢ6ࡀʣɺ࣍உʢ4ࡀʣ
12.  CEMI cemi
13. ⚫︎ CSV Excel Macro Injection ͱݺ͹ΕΔ੬ऑੑͷ͜ͱ ͦ΋ͦ΋CEMIͱ͸ʁ CEMI
14. ݕࡧͯ͠΋ͻ͔͔ͬΒͳ͍ CEMI
15. CSVͱηοτͰΑ͏΍͘ώοτ CEMI
16. ߈ܸऀ͕CSVϑΝΠϧͷதʹExcelͷϚΫϩ΍ؔ਺ΛؚΉσʔλΛૠೖ ߈ܸͷ࢓૊Έ̍ CEMI
17. ͜ͷϑΝΠϧ͕ྫ͑͹ExcelͰ։͔ΕΔͱɺૠೖ͞ΕͨϚΫϩ΍ؔ਺͕࣮ߦ͞ΕΔ ߈ܸͷ࢓૊Έ̎ CEMI
18. - ίϚϯυͷ࣮ߦ͕Ͱ͖Δ Windowsͷ৔߹ɺి୎͕࣮ߦͰ͖Δ =cmd|' /C calc'!A0 - ѱҙ͋ΔαʔόʔʹΞΫηεͤ͞Δ͜ͱ͕Ͱ͖ΔϦϯΫΛੜ੒Ͱ͖Δ =HYPERLINK(“https://example.com”) ةݥੑͷҰྫ CEMI
19. Լه಺༰ͰCSV࡞੒͢Δ - ֤ηϧϑΟʔϧυΛμϒϧΫΥʔτͰғΉ - ֤ηϧϑΟʔϧυͷલʹγϯάϧΫΦʔτΛ෇͚Δ - μϒϧΫΥʔτ͸͢΂ͯɺ͞ΒʹμϒϧΫΥʔτΛ࢖ͬͯΤεέʔϓ͢Δ ɹࢀߟهࣄɿOWASP | CSV Injection ɹhttps://owasp.org/www-community/attacks/CSV_Injection ରࡦ̍ CEMI
20. def generate_csv(users) CSV.generate(headers: true, force_quotes: true) do |csv| csv << ["ID", "Name", "Profile"] users.each do |user| csv << [ user.id, user.name, "'#{user.profile}" ] end end end RubyͰͷରԠ CEMI - force_quotes: trueʹΑΓɺ֤ηϧϑΟʔϧυΛμϒϧ ΫΥʔτͰғΉ͜ͱ͕Ͱ͖Δ - γϯάϧΫΥʔτ͸͚ͭͯ͋͛Δඞཁ͕͋Δ - จࣈྻͷμϒϧΫΥʔτ͸Τεέʔϓͯ͘͠ΕΔ ex: ͨͱ͑͹༩͑ΒΕͨจࣈྻ͕ʮ”NISHIOKA”ʯͷ৔ ߹ɺʮ””NISHIOKA””ʯͱͳΔ
21.  ։ൃνʔϜʹ͍ͭͯ about development teams