{"id":102221,"date":"2021-11-06T03:36:40","date_gmt":"2021-11-06T01:36:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/zahvat-kontrolya-nad-uyazvimymi-serverami-gitlab-dlya-vovlecheniya-v-provedenie-ddos-atak"},"modified":"2021-11-06T03:36:40","modified_gmt":"2021-11-06T01:36:40","slug":"zahvat-kontrolya-nad-uyazvimymi-serverami-gitlab-dlya-vovlecheniya-v-provedenie-ddos-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/zahvat-kontrolya-nad-uyazvimymi-serverami-gitlab-dlya-vovlecheniya-v-provedenie-ddos-atak","title":{"rendered":"Taking control of vulnerable GitLab servers to engage in DDoS attacks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitLab has warned users about an increase in malicious activity related to the exploitation of the critical vulnerability CVE-2021-22205, which allows remote code execution on the server running the GitLab collaborative development platform without authentication. <\/p>\n

The issue has been present in GitLab since version 11.9 and was fixed back in April in releases GitLab 13.10.3, 13.9.6, and 13.8.8. However, according to a scan conducted on October 31 of 60,000 publicly available GitLab instances, 50% of systems are still using outdated versions of GitLab that are vulnerable. Necessary updates have only been installed on 21% of the checked systems. servers<\/a>, while the version used could not be determined for 29% of the systems. <\/p>\n

Neglect by GitLab server administrators regarding updates has led to the vulnerability being actively exploited by attackers, who have begun deploying malware and connecting them to a botnet involved in DDoS attacks. servers<\/a> At its peak, the traffic during the DDoS attack generated by the botnet based on vulnerable GitLab servers reached up to 1 terabit per second. <\/p>\n

The vulnerability is caused by improper handling of uploaded image files by an external parser based on the ExifTool library. The vulnerability in ExifTool (CVE-2021-22204) allowed arbitrary commands to be executed on the system when parsing metadata from DjVu format files: (metadata \t (Copyright . qx{echo test >\\\/tmp\\\/test} . b <)) <\/p>\n

Moreover, since the actual format was determined in ExifTool by the content's MIME type rather than the file extension, an attacker could upload a DjVu document with an exploit disguised as a regular JPG or TIFF image (GitLab calls ExifTool for all files with jpg, jpeg, and tiff extensions to clean excess tags). Example of the exploit. In the default configuration of GitLab CE, the attack can be carried out by sending two requests that do not require authentication.

\"Taking<\/center> <\/p>\n

GitLab users are advised to ensure they are using the latest version, and if using an outdated release, to urgently install updates. If this is not possible for any reason, selectively apply a patch to block the vulnerability. Users of outdated systems are also encouraged to ascertain that their system has not been compromised by analyzing logs and checking for suspicious attacker accounts (such as dexbcx, dexbcx818, dexbcxh, dexbcxi, and dexbcxa99).
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitLab \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0431 \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-22205, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 GitLab. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 GitLab \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 11.9 \u0438 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0435\u0449\u0451 \u0432 \u0430\u043f\u0440\u0435\u043b\u0435 \u0432 \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0445 GitLab 13.10.3, 13.9.6 \u0438 13.8.8. \u0422\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102222,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102221","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Gaining control over vulnerable GitLab servers to engage in DDoS attacks | ProHoster","description":"GitLab has warned users about increased malicious activity related to the exploitation of the critical vulnerability CVE-2021-22205, which allows remote execution without authentication.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/zahvat-kontrolya-nad-uyazvimymi-serverami-gitlab-dlya-vovlecheniya-v-provedenie-ddos-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0417\u0430\u0445\u0432\u0430\u0442 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 GitLab \u0434\u043b\u044f \u0432\u043e\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0432 \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u0435 DDoS-\u0430\u0442\u0430\u043a | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f GitLab \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043e\u0431 \u0443\u0432\u0435\u043b\u0438\u0447\u0435\u043d\u0438\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u043e\u0439 \u0441 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2021-22205, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/zahvat-kontrolya-nad-uyazvimymi-serverami-gitlab-dlya-vovlecheniya-v-provedenie-ddos-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-06T01:36:40+00:00","article:modified_time":"2021-11-06T01:36:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102221","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-06 01:37:36","updated":"2026-02-09 16:51:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/102221","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=102221"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/102221\/revisions"}],"predecessor-version":[{"id":164406,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/102221\/revisions\/164406"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/102222"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=102221"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=102221"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=102221"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}