{"id":184064,"date":"2026-11-01T11:40:38","date_gmt":"2026-11-01T09:40:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataka-na-gitlab-server-proekta-alpine-linux"},"modified":"2026-11-01T11:40:41","modified_gmt":"2026-11-01T09:40:41","slug":"attack-on-alpine-linux-projects-gitlab-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","title":{"rendered":"Napad na GitLab-poslu\u017eitelj projekta Alpine Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Razvija\u010di distribucije Alpine Linux otkrili su informacije o poku\u0161ajima hakiranja platforme za zajedni\u010dki rad gitlab.alpinelinux.org, na kojoj su radili na paket menad\u017eeru APK, alatima za izgradnju, infrastrukturnim komponentama i skriptama za izgradnju paketa (aports). Napad je izvr\u0161en eksploatacijom ranjivosti na platformi GitLab, izazvane prekomjernim punjenjem cijelih brojeva u engineu regularnih izraza jezika Ruby. Dokazi i tragovi uspje\u0161nog hakiranja nisu prona\u0111eni, ali s obzirom na to da se potpuno isklju\u010denje uspje\u0161ne eksploatacije ranjivosti ne mo\u017ee smatrati mogu\u0107im, kontejner s GitLabom je progla\u0161en potencijalno kompromitiranim i njegovo je sadr\u017eajno potpuno rekonstruirano iz temelja, a korisnicima je pokrenuta procedura promjene lozinki.<\/p>\n

Administratori infrastrukture Alpine Linux nisu otkrili pojavu eksternih datoteka, sumnjivih pokrenutih procesa, neobi\u010dnih poziva prema API-ju, promjena postavki i sistemskih datoteka, kao ni skokova optere\u0107enja karakteristi\u010dnih za masovno va\u0111enje podataka. Tijekom analize cjelovitosti repozitorija aports, paketa i datoteka s izdanjima, kao i njihove usporedbe s kopijama s vanjskih servera za izgradnju i sustava programera, skrivene promjene nisu otkrivene.<\/p>\n

Potpuno isklju\u010diti uspje\u0161nu provedbu napada onemogu\u0107uje nedostatak informacija o odlaznim mre\u017enim vezama, brisanje nekih logova prilikom rotacije (npr. cron loga) i nedostatak odgovaraju\u0107e detaljnosti u logovima web servera (uspje\u0161na primjena eksploita koja ne dovodi do izvanrednog zavr\u0161etka ne odra\u017eava se u logu).
\nU slu\u010daju uspje\u0161nog napada, napada\u010di su mogli pristupiti bazi podataka s informacijama o svim korisnicima GitLaba (hash lozinki, email, IP adrese<\/a> itd.), varijablama okru\u017eenja i tokenima iz sustava kontinuirane integracije, kodovima za dvostruku autentifikaciju, hash-ima osobnih tokena pristupa, sadr\u017eaju privatnih repozitorija i povjerljivim raspravama o problemima. Klju\u010devi za stvaranje digitalnih potpisa za izdanja i pakete na napadnutom serveru<\/a> nisu se \u010duvali.<\/p>\n

Prve poku\u0161aje iskori\u0161tavanja ranjivosti zabilje\u017eene su 20. i 21. listopada. Napada\u010d je registrirao ra\u010dun na GitLabu i poku\u0161ao poslati modificirane postavke sustava za kontinuiranu integraciju. U logovima je zabilje\u017eeno 8 izvanrednih zavr\u0161etaka radnih procesa GitLaba, od kojih su 4 povezana s primjenom eksploitacije. Primje\u0107uje se da je prva faza funkcionalnosti eksploita bila uspje\u0161na, ali je druga faza zavr\u0161ila neuspjehom.<\/p>\n

Tijekom napada u kontejneru je kori\u0161tena ranjiva verzija GitLaba 19.3.4, koja je 22. listopada a\u017eurirana na izdanja GitLab 19.3.6. No, administratori Alpine nisu uzeli u obzir da je ispravak uveden samo u slu\u017ebenim instalacijskim paketima GitLab 19.3.6, a ne u samom kodu GitLaba, budu\u0107i da ranjivost postoji u Ruby alatu. U kontejneru je nastavljena upotreba starog Ruby alata, te je ranjivost ostala neispravljena. <\/p>\n

To da sustav ostaje ranjiv otkriveno je tek 26. listopada. Analiza logova pokazala je da su 25. i 26. listopada napada\u010di obnovili poku\u0161aje napada. 27. listopada pristup vanjskih korisnika GitLabu bio je ograni\u010den. 28. listopada sadr\u017eaj je ponovo sastavljen, sve lozinke su resetirane (korisnicima je potrebno postaviti novu lozinku putem postupka vra\u0107anja zaboravljene lozinke), a pristupni klju\u010devi su zamijenjeni. 29. listopada a\u017eurirani server<\/a> je pu\u0161ten u rad. Projekt Docker kontejner alpinelinux\/gitlab ostao je ranjiv sve do 27. listopada.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u043c\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (aports). \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 GitLab, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u044f\u0437\u044b\u043a\u0430 Ruby. \u0414\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0438 \u0441\u043b\u0435\u0434\u043e\u0432 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0432\u0437\u043b\u043e\u043c\u0430 \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184064","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Napad na GitLab poslu\u017eitelj projekta Alpine Linux | ProHoster","description":"Razvija\u010di distribucije Alpine Linux objavili su informacije o poku\u0161ajima hakiranja platforme za zajedni\u010dki rad gitlab.alpinelinux.org, na kojoj se radilo na paketnom menad\u017eeru APK i alatima za kompilaciju.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 GitLab-\u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Alpine Linux | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-01T09:40:38+00:00","article:modified_time":"2026-11-01T09:40:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/184064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=184064"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/184064\/revisions"}],"predecessor-version":[{"id":184065,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/184064\/revisions\/184065"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=184064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=184064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=184064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}