{"id":184064,"date":"2026-11-01T11:40:38","date_gmt":"2026-11-01T09:40:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataka-na-gitlab-server-proekta-alpine-linux"},"modified":"2026-11-01T11:40:41","modified_gmt":"2026-11-01T09:40:41","slug":"attack-on-alpine-linux-projects-gitlab-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","title":{"rendered":"T\u00e1mad\u00e1s az Alpine Linux projekt GitLab-szerver\u00e9n","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Az Alpine Linux disztr\u00f3 fejleszt\u0151i nyilv\u00e1noss\u00e1gra hozt\u00e1k, hogy megpr\u00f3b\u00e1lt\u00e1k felt\u00f6rni a gitlab.alpinelinux.org k\u00f6z\u00f6s fejleszt\u00e9si platformot, ahol az APK csomagkezel\u0151, a build eszk\u00f6z\u00f6k, az infrastrukt\u00fara komponensek \u00e9s a csomagok \u00f6ssze\u00e1ll\u00edt\u00e1s\u00e1hoz sz\u00fcks\u00e9ges szkriptek (aports) fejleszt\u00e9se zajlott. A t\u00e1mad\u00e1st a GitLab platformj\u00e1n tal\u00e1lhat\u00f3 s\u00e9r\u00fcl\u00e9kenys\u00e9g kihaszn\u00e1l\u00e1s\u00e1val hajtott\u00e1k v\u00e9gre, amelyet a Ruby programoz\u00e1si nyelv regul\u00e1ris kifejez\u00e9si motorj\u00e1ban fell\u00e9p\u0151 eg\u00e9sz sz\u00e1mok t\u00falcsordul\u00e1sa okozott. Bizony\u00edt\u00e9kokat \u00e9s a sikeres bet\u00f6r\u00e9s nyomait nem siker\u00fclt megtal\u00e1lni, de mivel a s\u00e9r\u00fcl\u00e9kenys\u00e9g sikeres kihaszn\u00e1l\u00e1sa nem z\u00e1rhat\u00f3 ki, a GitLab kont\u00e9nert potenci\u00e1lisan kompromitt\u00e1ltnak nyilv\u00e1n\u00edtott\u00e1k, \u00e9s tartalm\u00e1t teljesen \u00fajra\u00e9p\u00edtett\u00e9k, a felhaszn\u00e1l\u00f3kn\u00e1l pedig kezdem\u00e9nyezt\u00e9k a jelsz\u00f3v\u00e1lt\u00e1s folyamat\u00e1t.<\/p>\n

Az Alpine Linux infrastrukt\u00far\u00e1j\u00e1nak rendszergazd\u00e1i nem \u00e9szleltek idegen f\u00e1jlokat, gyan\u00fasan fut\u00f3 folyamatokat, szokatlan API-h\u00edv\u00e1sokat, be\u00e1ll\u00edt\u00e1sok \u00e9s rendszerszint\u0171 f\u00e1jlok m\u00f3dos\u00edt\u00e1s\u00e1t, valamint terhel\u00e9s ugr\u00e1sokat, amelyek a t\u00f6meges adatkinyer\u00e9sre jellemz\u0151ek. A repository (aports), csomagok \u00e9s kiad\u00e1si f\u00e1jlok integrit\u00e1s\u00e1nak elemz\u00e9se sor\u00e1n, valamint az ezeknek k\u00fcls\u0151 build szerverekr\u0151l \u00e9s fejleszt\u0151i rendszerekr\u0151l sz\u00e1rmaz\u00f3 m\u00e1solatokkal val\u00f3 \u00f6sszehasonl\u00edt\u00e1sa sor\u00e1n nem tal\u00e1ltak rejtett v\u00e1ltoztat\u00e1sokat.<\/p>\n

A sikeres t\u00e1mad\u00e1s teljes kiz\u00e1r\u00e1s\u00e1t megnehez\u00edti, hogy nincs inform\u00e1ci\u00f3 az outgoing h\u00e1l\u00f3zati kapcsolatokkal kapcsolatban, egyes napl\u00f3k t\u00f6rl\u00e9se a rot\u00e1ci\u00f3 sor\u00e1n (p\u00e9ld\u00e1ul a cron napl\u00f3ja), valamint a web szerver napl\u00f3iban a megfelel\u0151 r\u00e9szletess\u00e9g hi\u00e1nya (a sikertelen exploit alkalmaz\u00e1sa, amely nem vezetett a rendszer le\u00e1ll\u00e1s\u00e1hoz, nem t\u00fckr\u00f6z\u0151dik a napl\u00f3ban).
\nSikeres t\u00e1mad\u00e1s eset\u00e9n a t\u00e1mad\u00f3k hozz\u00e1f\u00e9rhettek volna a GitLab \u00f6sszes felhaszn\u00e1l\u00f3j\u00e1r\u00f3l sz\u00f3l\u00f3 adatb\u00e1zishoz (jelsz\u00f3hash-ek, e-mail, IP address<\/a> stb.), a k\u00f6rnyezeti v\u00e1ltoz\u00f3khoz \u00e9s a folyamatos integr\u00e1ci\u00f3s rendszerekb\u0151l sz\u00e1rmaz\u00f3 tokenekhez, a k\u00e9tfaktoros hiteles\u00edt\u00e9s k\u00f3djaihoz, a szem\u00e9lyes hozz\u00e1f\u00e9r\u00e9si tokenek hash-jeihez, a priv\u00e1t rep\u00f3k tartalm\u00e1hoz \u00e9s a bizalmas problematikus megbesz\u00e9l\u00e9sekhez. Az t\u00e1madott kiad\u00e1sokhoz \u00e9s csomagokhoz tartoz\u00f3 digit\u00e1lis al\u00e1\u00edr\u00e1sok gener\u00e1l\u00e1s\u00e1hoz sz\u00fcks\u00e9ges kulcsok nem voltak t\u00e1rolva. szerveren<\/a> A t\u00e1madott<\/p>\n

Az els\u0151 k\u00eds\u00e9rleteket a s\u00e9r\u00fcl\u00e9kenys\u00e9g kihaszn\u00e1l\u00e1s\u00e1ra okt\u00f3ber 20-\u00e1n \u00e9s 21-\u00e9n regisztr\u00e1lt\u00e1k. A t\u00e1mad\u00f3 l\u00e9trehozott egy fi\u00f3kot a GitLaben \u00e9s megpr\u00f3b\u00e1lta elk\u00fcldeni a m\u00f3dos\u00edtott folyamatos integr\u00e1ci\u00f3s be\u00e1ll\u00edt\u00e1sokat. A napl\u00f3kb\u00f3l nyolc GitLab munkafolyamat \u00f6sszeoml\u00e1sa volt r\u00f6gz\u00edtve, amelyek k\u00f6z\u00fcl n\u00e9gy a kihaszn\u00e1l\u00e1s alkalmaz\u00e1s\u00e1val kapcsolatos. Megjegyzend\u0151, hogy a kihaszn\u00e1l\u00f3 els\u0151 f\u00e1zis\u00e1nak v\u00e9grehajt\u00e1sa sikeres volt, de a m\u00e1sodik szakasz hiba miatt kudarcot vallott.<\/p>\n

A t\u00e1mad\u00e1s id\u0151pontj\u00e1ban a kont\u00e9nerben a GitLab 19.3.4 s\u00e9r\u00fcl\u00e9keny verzi\u00f3ja futott, amelyet okt\u00f3ber 22-\u00e9n friss\u00edtettek a GitLab 19.3.6 kiad\u00e1sra. Az Alpine rendszergazd\u00e1i azonban figyelmen k\u00edv\u00fcl hagyt\u00e1k, hogy a jav\u00edt\u00e1s csak a GitLab 19.3.6 hivatalos telep\u00edt\u0151csomagjaiba ker\u00fclt bele, \u00e9s nem a GitLab k\u00f3dj\u00e1ba, mivel a s\u00e9r\u00fcl\u00e9kenys\u00e9g a Ruby eszk\u00f6zk\u00e9szlet\u00e9ben tal\u00e1lhat\u00f3. A kont\u00e9nerben tov\u00e1bbra is a r\u00e9gi Ruby eszk\u00f6zk\u00e9szletet haszn\u00e1lt\u00e1k, ez\u00e9rt a s\u00e9r\u00fcl\u00e9kenys\u00e9g megmaradt. <\/p>\n

Hogy a rendszer tov\u00e1bbra is s\u00e9r\u00fcl\u00e9keny marad, azt csak okt\u00f3ber 26-\u00e1n fedezt\u00e9k fel. A napl\u00f3k elemz\u00e9se megmutatta, hogy okt\u00f3ber 25-\u00e9n \u00e9s 26-\u00e1n a t\u00e1mad\u00f3k folytatt\u00e1k a t\u00e1mad\u00e1si k\u00eds\u00e9rleteket. Okt\u00f3ber 27-\u00e9n a k\u00fcls\u0151 felhaszn\u00e1l\u00f3k hozz\u00e1f\u00e9r\u00e9se a GitLabhoz korl\u00e1toz\u00e1sra ker\u00fclt. Okt\u00f3ber 28-\u00e1n a tartalom \u00fajra\u00e9p\u00fclt, minden jelsz\u00f3 vissza\u00e1ll\u00edt\u00e1sra ker\u00fclt (a felhaszn\u00e1l\u00f3knak \u00faj jelsz\u00f3t kell be\u00e1ll\u00edtaniuk a jelsz\u00f3 helyre\u00e1ll\u00edt\u00e1si elj\u00e1r\u00e1s sor\u00e1n), \u00e9s a hozz\u00e1f\u00e9r\u00e9si kulcsok cser\u00e9re ker\u00fcltek. Okt\u00f3ber 29-\u00e9n a friss\u00edtett szerver<\/a> telep\u00edt\u00e9sre ker\u00fclt. A Docker-kont\u00e9neres alpinelinux\/gitlab projekt tov\u00e1bbra is s\u00e9r\u00fcl\u00e9keny maradt eg\u00e9szen okt\u00f3ber 27-ig.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u043c\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (aports). \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 GitLab, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u044f\u0437\u044b\u043a\u0430 Ruby. \u0414\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0438 \u0441\u043b\u0435\u0434\u043e\u0432 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0432\u0437\u043b\u043e\u043c\u0430 \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184064","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47T\u00e1mad\u00e1s a GitLab szerver ellen az Alpine Linux projektn\u00e9l | ProHoster","description":"Az Alpine Linux disztrib\u00faci\u00f3 fejleszt\u0151i felfedt\u00e9k a gitlab.alpinelinux.org k\u00f6zrem\u0171k\u00f6d\u00e9si platform hackel\u00e9si pr\u00f3b\u00e1lkoz\u00e1sair\u00f3l sz\u00f3l\u00f3 inform\u00e1ci\u00f3t, ahol az APK csomagkezel\u0151 \u00e9s a build eszk\u00f6z\u00f6k fejleszt\u00e9s\u00e9n dolgoztak.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 GitLab-\u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Alpine Linux | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-01T09:40:38+00:00","article:modified_time":"2026-11-01T09:40:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/184064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=184064"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/184064\/revisions"}],"predecessor-version":[{"id":184065,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/184064\/revisions\/184065"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=184064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=184064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=184064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}