{"id":47755,"date":"2026-04-24T22:37:03","date_gmt":"2026-04-24T15:37:03","guid":{"rendered":"https:\/\/antoanthongtinhaiphong.gov.vn\/?p=47755"},"modified":"2026-05-05T22:37:48","modified_gmt":"2026-05-05T15:37:48","slug":"lo-hong-terrarium-nguy-co-thoat-sandbox-chiem-quyen-he-thong","status":"publish","type":"post","link":"https:\/\/antoanthongtinhaiphong.gov.vn\/lo-hong-terrarium-nguy-co-thoat-sandbox-chiem-quyen-he-thong\/","title":{"rendered":"L\u1ed7 h\u1ed5ng Terrarium: Nguy c\u01a1 \u201ctho\u00e1t sandbox\u201d, chi\u1ebfm quy\u1ec1n h\u1ec7 th\u1ed1ng"},"content":{"rendered":"
M\u1ed9t l\u1ed7 h\u1ed5ng v\u1eeba \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 trong c\u00f4ng c\u1ee5 sandbox Python c\u00f3 t\u00ean Terrarium \u0111ang khi\u1ebfn gi\u1edbi an ninh m\u1ea1ng \u0111\u1eb7c bi\u1ec7t lo ng\u1ea1i. V\u1edbi \u0111i\u1ec3m s\u1ed1 CVSS l\u00ean t\u1edbi 9,3\/10, l\u1ed7 h\u1ed5ng n\u00e0y cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng th\u1ef1c thi m\u00e3 t\u00f9y \u00fd v\u00e0 th\u1eadm ch\u00ed chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n h\u1ec7 th\u1ed1ng, l\u00e0m d\u1ea5y l\u00ean r\u1ee7i ro l\u1edbn \u0111\u1ed1i v\u1edbi c\u00e1c m\u00f4i tr\u01b0\u1eddng x\u1eed l\u00fd m\u00e3 kh\u00f4ng \u0111\u00e1ng tin c\u1eady, \u0111\u1eb7c bi\u1ec7t trong b\u1ed1i c\u1ea3nh AI v\u00e0 l\u1eadp tr\u00ecnh t\u1ef1 \u0111\u1ed9ng ng\u00e0y c\u00e0ng ph\u1ed5 bi\u1ebfn.<\/b>
\n\u200b<\/div>\n
\n
\"1776929682276.png\"<\/div>\n<\/div>\n
\nL\u1ed7 h\u1ed5ng \u0111\u01b0\u1ee3c \u0111\u1ecbnh danh l\u00e0 CVE-2026-5752, t\u1ed3n t\u1ea1i trong c\u01a1 ch\u1ebf c\u00e1ch ly c\u1ee7a Terrarium (m\u00f4i tr\u01b0\u1eddng \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 ch\u1ea1y m\u00e3 Python kh\u00f4ng tin c\u1eady b\u00ean trong container). V\u1ec1 b\u1ea3n ch\u1ea5t, \u0111\u00e2y l\u00e0 m\u1ed9t l\u1ed7i \u201csandbox escape\u201d, cho ph\u00e9p m\u00e3 \u0111\u1ed9c tho\u00e1t kh\u1ecfi m\u00f4i tr\u01b0\u1eddng b\u1ecb gi\u1edbi h\u1ea1n v\u00e0 t\u01b0\u01a1ng t\u00e1c tr\u1ef1c ti\u1ebfp v\u1edbi h\u1ec7 th\u1ed1ng ch\u1ee7.<\/p>\n

Nguy\u00ean nh\u00e2n c\u1ed1t l\u00f5i c\u1ee7a l\u1ed7 h\u1ed5ng n\u1eb1m \u1edf c\u00e1ch Terrarium s\u1eed d\u1ee5ng Pyodide (m\u00f4i tr\u01b0\u1eddng Python ch\u1ea1y tr\u00ean WebAssembly). Trong qu\u00e1 tr\u00ecnh n\u00e0y, h\u1ec7 th\u1ed1ng kh\u00f4ng ki\u1ec3m so\u00e1t ch\u1eb7t ch\u1ebd vi\u1ec7c truy c\u1eadp v\u00e0o chu\u1ed7i nguy\u00ean m\u1eabu (prototype chain) c\u1ee7a JavaScript. \u0110i\u1ec1u n\u00e0y t\u1ea1o ra m\u1ed9t \u0111i\u1ec3m y\u1ebfu cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng th\u1ef1c hi\u1ec7n k\u1ef9 thu\u1eadt \u201cprototype chain traversal\u201d, t\u1eeb \u0111\u00f3 v\u01b0\u1ee3t qua c\u00e1c ranh gi\u1edbi b\u1ea3o m\u1eadt v\u1ed1n \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 c\u00f4 l\u1eadp m\u00e3 th\u1ef1c thi.<\/p>\n

C\u01a1 ch\u1ebf khai th\u00e1c l\u1ed7 h\u1ed5ng t\u01b0\u01a1ng \u0111\u1ed1i r\u00f5 r\u00e0ng nh\u01b0ng c\u1ef1c k\u1ef3 nguy hi\u1ec3m. Khi k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 quy\u1ec1n \u0111\u01b0a m\u00e3 v\u00e0o sandbox (d\u00f9 l\u00e0 do ng\u01b0\u1eddi d\u00f9ng nh\u1eadp ho\u1eb7c do h\u1ec7 th\u1ed1ng AI sinh ra), \u0111o\u1ea1n m\u00e3 \u0111\u1ed9c c\u00f3 th\u1ec3 l\u1ee3i d\u1ee5ng \u0111i\u1ec3m y\u1ebfu trong Pyodide \u0111\u1ec3 truy c\u1eadp v\u00e0o c\u00e1c \u0111\u1ed1i t\u01b0\u1ee3ng c\u1ea5p cao h\u01a1n trong m\u00f4i tr\u01b0\u1eddng “Node.js”. T\u1eeb \u0111\u00f3, ch\u00fang c\u00f3 th\u1ec3 th\u1ef1c thi c\u00e1c l\u1ec7nh h\u1ec7 th\u1ed1ng v\u1edbi quy\u1ec1n cao nh\u1ea5t b\u00ean trong container. Kh\u00f4ng d\u1eebng l\u1ea1i \u1edf \u0111\u00f3, k\u1ebb t\u1ea5n c\u00f4ng c\u00f2n c\u00f3 kh\u1ea3 n\u0103ng truy c\u1eadp c\u00e1c t\u1ec7p nh\u1ea1y c\u1ea3m nh\u01b0 \u201c\/etc\/passwd\u201d, d\u00f2 qu\u00e9t m\u1ea1ng n\u1ed9i b\u1ed9 c\u1ee7a container, v\u00e0 trong m\u1ed9t s\u1ed1 tr\u01b0\u1eddng h\u1ee3p, c\u00f3 th\u1ec3 m\u1edf r\u1ed9ng t\u1ea5n c\u00f4ng ra ngo\u00e0i container.<\/p>\n

\u0110i\u1ec3m \u0111\u00e1ng ch\u00fa \u00fd l\u00e0 vi\u1ec7c khai th\u00e1c kh\u00f4ng y\u00eau c\u1ea7u t\u01b0\u01a1ng t\u00e1c ng\u01b0\u1eddi d\u00f9ng v\u00e0 c\u0169ng kh\u00f4ng c\u1ea7n \u0111\u1eb7c quy\u1ec1n cao tr\u01b0\u1edbc \u0111\u00f3. Ch\u1ec9 c\u1ea7n c\u00f3 kh\u1ea3 n\u0103ng \u0111\u01b0a m\u00e3 v\u00e0o h\u1ec7 th\u1ed1ng, k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 c\u00f3 th\u1ec3 k\u00edch ho\u1ea1t chu\u1ed7i t\u1ea5n c\u00f4ng ho\u00e0n ch\u1ec9nh. \u0110i\u1ec1u n\u00e0y khi\u1ebfn l\u1ed7 h\u1ed5ng tr\u1edf n\u00ean \u0111\u1eb7c bi\u1ec7t nguy hi\u1ec3m trong c\u00e1c n\u1ec1n t\u1ea3ng cho ph\u00e9p ch\u1ea1y m\u00e3 \u0111\u1ed9ng, ch\u1eb3ng h\u1ea1n nh\u01b0 c\u00e1c h\u1ec7 th\u1ed1ng t\u00edch h\u1ee3p m\u00f4 h\u00ecnh LLM ho\u1eb7c m\u00f4i tr\u01b0\u1eddng ph\u00e1t tri\u1ec3n tr\u1ef1c tuy\u1ebfn.<\/p>\n

R\u1ee7i ro t\u1eeb l\u1ed7 h\u1ed5ng n\u00e0y kh\u00f4ng ch\u1ec9 d\u1eebng \u1edf vi\u1ec7c chi\u1ebfm quy\u1ec1n h\u1ec7 th\u1ed1ng. Trong th\u1ef1c t\u1ebf, n\u00f3 c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn h\u00e0ng lo\u1ea1t h\u1ec7 qu\u1ea3 nghi\u00eam tr\u1ecdng nh\u01b0 r\u00f2 r\u1ec9 d\u1eef li\u1ec7u, leo thang \u0111\u1eb7c quy\u1ec1n, ho\u1eb7c tr\u1edf th\u00e0nh b\u00e0n \u0111\u1ea1p cho c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng s\u00e2u h\u01a1n v\u00e0o h\u1ea1 t\u1ea7ng doanh nghi\u1ec7p. \u0110\u1eb7c bi\u1ec7t, trong c\u00e1c m\u00f4i tr\u01b0\u1eddng multi-tenant ho\u1eb7c cloud, m\u1ed9t \u0111i\u1ec3m y\u1ebfu nh\u01b0 v\u1eady c\u00f3 th\u1ec3 \u1ea3nh h\u01b0\u1edfng d\u00e2y chuy\u1ec1n \u0111\u1ebfn nhi\u1ec1u d\u1ecbch v\u1ee5 kh\u00e1c.<\/p>\n

M\u1ed9t v\u1ea5n \u0111\u1ec1 \u0111\u00e1ng lo ng\u1ea1i h\u01a1n l\u00e0 d\u1ef1 \u00e1n Terrarium hi\u1ec7n kh\u00f4ng c\u00f2n \u0111\u01b0\u1ee3c duy tr\u00ec t\u00edch c\u1ef1c, \u0111\u1ed3ng ngh\u0129a v\u1edbi vi\u1ec7c kh\u1ea3 n\u0103ng xu\u1ea5t hi\u1ec7n b\u1ea3n v\u00e1 ch\u00ednh th\u1ee9c l\u00e0 r\u1ea5t th\u1ea5p. \u0110i\u1ec1u n\u00e0y bu\u1ed9c c\u00e1c t\u1ed5 ch\u1ee9c \u0111ang s\u1eed d\u1ee5ng c\u00f4ng c\u1ee5 n\u00e0y ph\u1ea3i ch\u1ee7 \u0111\u1ed9ng tri\u1ec3n khai c\u00e1c bi\u1ec7n ph\u00e1p ph\u00f2ng v\u1ec7 thay th\u1ebf thay v\u00ec ch\u1edd \u0111\u1ee3i c\u1eadp nh\u1eadt t\u1eeb nh\u00e0 ph\u00e1t tri\u1ec3n.\u200b<\/p><\/div>\n

Gi\u1ea3i ph\u00e1p v\u00e0 khuy\u1ebfn ngh\u1ecb<\/b>\u200b<\/div>\n
Tr\u01b0\u1edbc m\u1ee9c \u0111\u1ed9 r\u1ee7i ro cao, c\u00e1c chuy\u00ean gia an ninh m\u1ea1ng khuy\u1ebfn ngh\u1ecb c\u1ea7n nhanh ch\u00f3ng \u0111\u00e1nh gi\u00e1 l\u1ea1i vi\u1ec7c s\u1eed d\u1ee5ng Terrarium trong h\u1ec7 th\u1ed1ng. N\u1ebfu kh\u00f4ng th\u1ec3 thay th\u1ebf ngay, c\u1ea7n h\u1ea1n ch\u1ebf t\u1ed1i \u0111a kh\u1ea3 n\u0103ng ng\u01b0\u1eddi d\u00f9ng g\u1eedi m\u00e3 v\u00e0o sandbox, \u0111\u1eb7c bi\u1ec7t l\u00e0 t\u1eeb c\u00e1c ngu\u1ed3n kh\u00f4ng \u0111\u00e1ng tin c\u1eady.<\/p>\n

B\u00ean c\u1ea1nh \u0111\u00f3, vi\u1ec7c ph\u00e2n t\u00e1ch m\u1ea1ng c\u1ea7n \u0111\u01b0\u1ee3c \u00e1p d\u1ee5ng \u0111\u1ec3 gi\u1ea3m thi\u1ec3u kh\u1ea3 n\u0103ng lan r\u1ed9ng n\u1ebfu h\u1ec7 th\u1ed1ng b\u1ecb x\u00e2m nh\u1eadp. C\u00e1c container n\u00ean \u0111\u01b0\u1ee3c gi\u00e1m s\u00e1t ch\u1eb7t ch\u1ebd \u0111\u1ec3 ph\u00e1t hi\u1ec7n h\u00e0nh vi b\u1ea5t th\u01b0\u1eddng, \u0111\u1ed3ng th\u1eddi gi\u1edbi h\u1ea1n quy\u1ec1n truy c\u1eadp ch\u1ec9 cho c\u00e1c \u0111\u1ed1i t\u01b0\u1ee3ng c\u1ea7n thi\u1ebft. Vi\u1ec7c tri\u1ec3n khai t\u01b0\u1eddng l\u1eeda \u1ee9ng d\u1ee5ng web (WAF) c\u0169ng gi\u00fap ph\u00e1t hi\u1ec7n v\u00e0 ng\u0103n ch\u1eb7n c\u00e1c y\u00eau c\u1ea7u khai th\u00e1c l\u1ed7 h\u1ed5ng.<\/p>\n

Quan tr\u1ecdng h\u01a1n, c\u00e1c t\u1ed5 ch\u1ee9c n\u00ean xem x\u00e9t thay th\u1ebf Terrarium b\u1eb1ng c\u00e1c gi\u1ea3i ph\u00e1p sandbox \u0111\u01b0\u1ee3c duy tr\u00ec v\u00e0 ki\u1ec3m to\u00e1n b\u1ea3o m\u1eadt th\u01b0\u1eddng xuy\u00ean. Trong b\u1ed1i c\u1ea3nh c\u00e1c h\u1ec7 th\u1ed1ng AI ng\u00e0y c\u00e0ng ph\u1ee5 thu\u1ed9c v\u00e0o vi\u1ec7c x\u1eed l\u00fd m\u00e3 \u0111\u1ed9ng, vi\u1ec7c l\u1ef1a ch\u1ecdn n\u1ec1n t\u1ea3ng an to\u00e0n l\u00e0 y\u1ebfu t\u1ed1 s\u1ed1ng c\u00f2n.\u200b<\/p><\/div>\n

Theo The Hacker News<\/i><\/b><\/div>\n","protected":false},"excerpt":{"rendered":"

M\u1ed9t l\u1ed7 h\u1ed5ng v\u1eeba \u0111\u01b0\u1ee3c c\u00f4ng b\u1ed1 trong c\u00f4ng c\u1ee5 sandbox Python c\u00f3 t\u00ean Terrarium \u0111ang khi\u1ebfn gi\u1edbi an ninh m\u1ea1ng \u0111\u1eb7c bi\u1ec7t lo ng\u1ea1i. V\u1edbi \u0111i\u1ec3m s\u1ed1 CVSS l\u00ean t\u1edbi 9,3\/10, l\u1ed7 h\u1ed5ng n\u00e0y cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng th\u1ef1c thi m\u00e3 t\u00f9y \u00fd v\u00e0 th\u1eadm ch\u00ed chi\u1ebfm quy\u1ec1n \u0111i\u1ec1u khi\u1ec3n h\u1ec7 th\u1ed1ng, l\u00e0m […]<\/p>\n","protected":false},"author":20,"featured_media":47756,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"tdm_status":"","tdm_grid_status":"","footnotes":""},"categories":[3,24,35],"tags":[],"class_list":["post-47755","post","type-post","status-publish","format-standard","has-post-thumbnail","category-canh-bao-khuyen-nghi","category-tin-noi-bat","category-tin-tuc-su-kien"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/47755","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/comments?post=47755"}],"version-history":[{"count":1,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/47755\/revisions"}],"predecessor-version":[{"id":47757,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/posts\/47755\/revisions\/47757"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media\/47756"}],"wp:attachment":[{"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/media?parent=47755"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/categories?post=47755"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antoanthongtinhaiphong.gov.vn\/wp-json\/wp\/v2\/tags?post=47755"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}