Developers of the mobile platform , which replaced CyanogenMod, reported on the discovery of traces of a breach in the project's infrastructure. It is noted that at 6 a.m. (MSK) on May 3, the attacker was able to gain access to the main server of the centralized configuration management system through the exploitation of an unpatched vulnerability. Currently, an investigation into the incident is underway and details are not yet available.
only that the attack did not affect the keys for generating digital signatures, the build system, and the source code of the platform—keys on hosts that were completely isolated from the main infrastructure, managed via SaltStack, and the builds were stopped for technical reasons on April 30. According to the data on the page the developers have already restored the server with the code review system Gerrit, the website, and the wiki. The build server (builds.lineageos.org), the file download portal (download.lineageos.org), email servers, and the mirror coordination system remain disconnected.
The attack was made possible because the network port (4506) for accessing SaltStack blocked for external requests by the firewall—allowing the attacker to wait for a critical vulnerability in SaltStack to appear and exploit it before the administrators could apply the patch. All users of SaltStack are urgently advised to update their systems and check for signs of a breach.
It appears that attacks via SaltStack were not limited to the breach of LineageOS and became widespread—throughout the day, various users who did not manage to update SaltStack identified compromises in their infrastructures with code for mining or backdoors placed on their servers. In particular about a similar breach of the content management system , which affected the Ghost(Pro) websites and billing (it is claimed that credit card numbers were not compromised, but hashes of Ghost users' passwords may have fallen into the hands of attackers).
On April 29, updates for the SaltStack platform were in which vulnerabilities were addressed and , details about the vulnerabilities were published on April 30, assigned the highest level of danger as they allow access without authentication them to be accessed Remote code execution both on the management host (salt-master) and on all servers managed through it.
- The first vulnerability () is caused by a lack of proper checks when calling methods of the ClearFuncs class during the salt-master process. This vulnerability allows a remote user to access certain methods without authentication. Notably, through the problematic methods, an attacker can obtain a token for root access to the master server and execute any commands on the managed hosts running the . A patch addressing this vulnerability was released 20 days ago, but after its application, there were , leading to failures and file synchronization disruptions.
- The second vulnerability () allows access to methods through manipulation of the ClearFuncs class by passing specially formatted paths, which can be used for full access to arbitrary directories in the master server's file system with root rights, but requires authenticated access (such access can be obtained via the first vulnerability and the second vulnerability can be used for complete compromise of the entire infrastructure).
Source: opennet.ru
