{"id":184064,"date":"2026-11-01T11:40:38","date_gmt":"2026-11-01T09:40:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataka-na-gitlab-server-proekta-alpine-linux"},"modified":"2026-11-01T11:40:41","modified_gmt":"2026-11-01T09:40:41","slug":"attack-on-alpine-linux-projects-gitlab-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","title":{"rendered":"R\u00fcnnak Alpine Linuxi projekti GitLab-serverile","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Alpine Linuxi distributsi arendajad avalikustasid teavet h\u00e4kkimis\u00fcrituse kohta \u00fchise arenduse platvormil gitlab.alpinelinux.org, kus t\u00f6\u00f6tati APK paketihalduri, koostamisriistade, infrastruktuurikomponentide ja paketihalduse skriptide (aports) kallal. R\u00fcnnak toimus GitLabi platvormi haavatavuse kaudu, mille p\u00f5hjustas Ruby regulaaravaldiste mootori t\u00e4isarvude \u00fclevool. T\u00f5endeid ja j\u00e4lgi eduka h\u00e4kkimise kohta ei leitud, kuid kuna ei ole v\u00f5imalik t\u00e4ielikult v\u00e4listada haavatavuse edukat kasutamist, tunnistati GitLabi konteiner potentsiaalselt kompromiteerituks ning selle sisu ehitati t\u00e4ielikult nullist \u00fcmber ja kasutajatele algatati paroolivahetusprotseduur.<\/p>\n

Alpine Linuxi infrastruktuuri administraatorid ei tuvastanud kolmandate osapoolte failide, kahtlaste k\u00e4ivitatud protsesside, ebatavaliste API p\u00e4ringute, seadete ja s\u00fcsteemifailide muutuste ning massilise andmeekstraktsioonile iseloomulike koormuse h\u00fcppeid. Aports reposti, pakettide ja v\u00e4ljaannete failide terviklikkuse anal\u00fc\u00fcsi k\u00e4igus ning nende v\u00f5rdlemisel v\u00e4listest koostamisserveritest ja arendajate s\u00fcsteemidest ei tuvastatud varjatud muudatusi.<\/p>\n

\u00dcksikasjalik v\u00e4listamine eduka r\u00fcnnaku toimumise kohta on keeruline, kuna puudub teave v\u00e4ljaminevate v\u00f5rguseoste kohta, m\u00f5ned logid on logimise k\u00e4igus eemaldatud (nt cron-log) ning veebiserveri logides puudub vajalik detailitase (eduka ekspluateerimise rakendamine, mis ei loo kokkuvarisemist, ei peegeldu logis).
\nEdasi viia r\u00fcnnaku korral oleks kurjategijatel olnud juurdep\u00e4\u00e4s GitLabi andmebaasile, kus on teave k\u00f5ikide kasutajate kohta (paroolide r\u00e4si, e-posti aadressid, IP-aadressid<\/a> jne), keskkonnamuutujad ja pideva integreerimise s\u00fcsteemide tokenid, kahefaktorilise autentimise koodid, isiklike juurdep\u00e4\u00e4sutokenite r\u00e4si, privaatsete hoidlate sisu ja tundlikud probleemide arutelud. R\u00fcnnaku k\u00e4igus ei hoidnud digitaalsete allkirjade genereerimise v\u00f5tmeid v\u00e4ljaannetele ja pakettidele. serveris<\/a> kuskil.<\/p>\n

Esimene katse turvan\u00f5rkust \u00e4ra kasutada toimusid 20. ja 21. oktoobril. R\u00fcndaja registreeris konto GitLabis ja proovis saata muudetud pideva integreerimise s\u00fcsteemi seadistusi. Logides on fikseeritud 8 GitLabi t\u00f6\u00f6voo avariilist l\u00f5petamist, millest 4 on seotud eksploidiga. T\u00e4heldatakse, et eksploodi esimene faas oli edukas, kuid teine etapp eba\u00f5nnestus.<\/p>\n

R\u00fcnnaku hetkel kasutati konteineris haavatavat GitLab versiooni 19.3.4, mis uuendati 22. oktoobril versiooniks GitLab 19.3.6. Kuid Alpine'i administraatorid ei arvestanud, et parandused tehti ainult ametlikele GitLab 19.3.6 installipakettidele, mitte GitLabi koodile, kuna haavatavus on Ruby t\u00f6\u00f6riistakomplektis. Konteineris kasutati endiselt vana Ruby t\u00f6\u00f6riistakomplekti ja haavatavus j\u00e4i lahendamata. <\/p>\n

S\u00fcsteemi haavatavuse j\u00e4tkumine tuvastati alles 26. oktoobril. Logide anal\u00fc\u00fcs n\u00e4itas, et 25. ja 26. oktoobril j\u00e4tkasid r\u00fcndajad katseid r\u00fcnnaku sooritamiseks. 27. oktoobril piirati v\u00e4liste kasutajate juurdep\u00e4\u00e4s GitLabile. 28. oktoobril koostati sisu uuesti, k\u00f5ik paroolid l\u00e4htestati (kasutajatel on vajalik saata uus parool unustatud parooli taastamise protseduuri kaudu), ja ligip\u00e4\u00e4suv\u00f5tmed vahetati. 29. oktoobril uuendatud server<\/a> viidi sisse. Docker-konteineri alpinelinux\/gitlab projekt j\u00e4i haavatavaks kuni 27. oktoobrini.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u043c\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (aports). \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 GitLab, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u044f\u0437\u044b\u043a\u0430 Ruby. \u0414\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0438 \u0441\u043b\u0435\u0434\u043e\u0432 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0432\u0437\u043b\u043e\u043c\u0430 \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184064","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fcnnak GitLab serverile Alpine Linuxi projekti | ProHoster","description":"Alpine Linuxi distributsiooni arendajad avaldasid teavet katsetest h\u00e4kkida koost\u00f6\u00f6platvormi gitlab.alpinelinux.org, kus t\u00f6\u00f6tati pakihalduri APK ja ehitusriistade kallal.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 GitLab-\u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Alpine Linux | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-01T09:40:38+00:00","article:modified_time":"2026-11-01T09:40:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/184064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=184064"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/184064\/revisions"}],"predecessor-version":[{"id":184065,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/184064\/revisions\/184065"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=184064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=184064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=184064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}