Developers of the open-source content management system Plone, written in Python and JavaScript/NodeJS, have reported an incident in which malicious code was added to the project's GitHub git repository. Initially, three changes were identified in the repository on January 7 (1, 2, 3), which added malicious code to the project's JavaScript files (1, 2, 3). An investigation into the incident revealed that the integration of the malicious code was the result of a compromise of one of the developer's accounts, whose access token was captured by attackers after malware was executed on his system.
On January 14, the compromised account was blocked, and project developers were advised to analyze commits from January 1 to January 14. On January 27, it was discovered that the affected commits were not limited to those dates and that the attack impacted five of the project's repositories (plone/volto, plone/mockup, plone/plone.app.mosaic, plone/critical-css-cli, plone/plonetheme.barceloneta), into which malicious code was seamlessly integrated. In the case of the plone.app.mosaic repository, the attackers managed to substitute the master branch. The attack occurred two months after the developer's access token was compromised.
To integrate changes instead of regular commits, the attackers used the 'force push' operation (git push with the '--force' option), which allows forcefully replacing a branch in an external repository with their own content and, consequently, rewriting the change history (after replacement, the history from the branch uploaded by the attackers is displayed). To prevent such branch substitutions in the future, Plone developers implemented rules in GitHub that block 'force push' operations for main branches and tags.
In the repository plone.app.mosaic, to complicate the detection of the compromise, attackers inserted a malicious commit into the master branch with a false date of December 18, believing that the search area for malicious code would focus on changes made after their first activity in the repository. The malicious change was presented in the substituted commit as the beginning of the development of a new test release, but besides the version number change in the metadata (from 4.0.0a1 to 4.0.0a2.dev0), malicious code was added to the JavaScript file prettier.config.js invoked during the build stage. To conceal the code when viewing changes in the terminal, it was added in a single line with a legitimate operation and offset from the visible area using spaces. In the GitHub interface, this code was also not shown by default and required clicking the 'Load Diff' button.
The attack was more targeted at the project's developers than at users. Malicious changes were not included in the release. The malicious code was activated during the build, loading exploits for privilege escalation, setting up autostart by calling its processes from startup scripts, and allowing remote control. proxy serverIn addition, the installed malicious component searched for and sent confidential data, such as access tokens, browser profiles, and keys from cryptocurrency wallets.
Source: opennet.ru
