The developers of the Alpine Linux distribution disclosed information about attempted hacks on the collaborative development platform gitlab.alpinelinux.org, which was used for working on the APK package manager, build tools, infrastructure components, and package build scripts (aports). The attack was executed through the exploitation of a vulnerability in the GitLab platform caused by an integer overflow in the Ruby regular expression engine. No evidence or traces of a successful hack could be found, but since it is not possible to completely rule out the successful exploitation of the vulnerability, the GitLab container was deemed potentially compromised, and its contents were completely rebuilt from scratch, with users initiated to change their passwords.
The administrators of the Alpine Linux infrastructure found no evidence of foreign files, suspicious running processes, unusual API calls, changes in settings or system files, or spikes in load characteristic of mass data extraction. During the integrity analysis of the aports repository, packages, and release files, as well as their verification against copies from external build servers and developer systems, no hidden changes were detected.
The absence of information on outgoing network connections, the deletion of some logs during rotation (for example, the cron log), and the lack of proper detail in the web server logs (successful exploitation that does not lead to a crash is not reflected in the log) do not allow for completely ruling out the successful conduct of an attack.
In the case of a successful attack, the attackers could have accessed the database containing data about all GitLab users (password hashes, email, an IP address etc.), environment variables and tokens from continuous integration systems, two-factor authentication codes, personal access token hashes, private repository contents, and confidential issue discussions. Keys for generating digital signatures for releases and packages were not stored on the attacked server .
The first attempts to exploit the vulnerability were recorded on October 20 and 21. The attacker registered an account on GitLab and tried to send modified continuous integration system settings. The logs recorded 8 crash completions of GitLab processes, 4 of which were related to the use of the exploit. It was noted that the first phase of the exploit's operation was successful, but the second stage failed.
At the time of the attack, the container was running a vulnerable version of GitLab 19.3.4, which was updated to GitLab 19.3.6 on October 22. However, the Alpine administrators did not consider that the fix was only applied to the official installation packages of GitLab 19.3.6, not the GitLab code itself, as the vulnerability existed in the Ruby toolkit. The container continued to use the outdated Ruby toolkit, leaving the vulnerability unpatched.
The fact that the system remained vulnerable was only identified on October 26. A review of the logs showed that on October 25 and 26, the attackers resumed their attempts to carry out the attack. On October 27, access for external users to GitLab was restricted. On October 28, the content was rebuilt, all passwords were reset (users need to set a new password through the forgotten password recovery process), and access keys were replaced. On October 29, the updated server was put into operation. The Docker container project alpinelinux/gitlab remained vulnerable until October 27.
Source: opennet.ru
