{"id":184064,"date":"2026-11-01T11:40:38","date_gmt":"2026-11-01T09:40:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataka-na-gitlab-server-proekta-alpine-linux"},"modified":"2026-11-01T11:40:41","modified_gmt":"2026-11-01T09:40:41","slug":"attack-on-alpine-linux-projects-gitlab-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","title":{"rendered":"Uzbrukums GitLab serverim Alpine Linux projekt\u0101","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Alpine Linux izstr\u0101d\u0101t\u0101ji atkl\u0101ju\u0161i inform\u0101ciju par m\u0113\u0123in\u0101jumiem uzlauzt kop\u012bga izstr\u0101d\u0101\u0161anas platformu gitlab.alpinelinux.org, kur tika str\u0101d\u0101ts pie pakot\u0146u p\u0101rvaldnieka APK, kompil\u0101cijas r\u012bkiem, infrastrukt\u016bras komponentiem un pakot\u0146u kompil\u0101cijas skriptiem (aports). Uzbrukums tika veikts, izmantojot ievainojam\u012bbu GitLab platform\u0101, ko izrais\u012bja veselo skait\u013cu p\u0101rapsaiste Ruby regul\u0101ro izteiksmju dzin\u0113j\u0101. Pier\u0101d\u012bjumi un sekas veiksm\u012bgai uzlau\u0161anai netika atrastas, ta\u010du, t\u0101 k\u0101 piln\u012bb\u0101 izsl\u0113gt veiksm\u012bgu ievainojam\u012bbas izmanto\u0161anu nav iesp\u0113jams, GitLab konteiners tika atz\u012bts par potenci\u0101li apdraud\u0113tu, un t\u0101 saturs tika piln\u012bb\u0101 p\u0101rveidots no nulles, k\u0101 ar\u012b lietot\u0101jiem tika uzs\u0101kta paroles mai\u0146as proced\u016bra.<\/p>\n

Alpine Linux infrastrukt\u016bras administratori nav konstat\u0113ju\u0161i sve\u0161u failu par\u0101d\u012b\u0161anos, aizdom\u012bgu procesu palai\u0161anu, neparastus API piepras\u012bjumus, iestat\u012bjumu un sist\u0113mas failu izmai\u0146as, k\u0101 ar\u012b slodzes sv\u0101rst\u012bbas, kas rakstur\u012bgas masveida datu ieguvei. P\u0101rbaudot aports kr\u0101tuves, pakot\u0146u un versiju failu integrit\u0101ti, k\u0101 ar\u012b sal\u012bdzinot tos ar kopij\u0101m no \u0101r\u0113jiem kompil\u0101cijas serveriem un izstr\u0101d\u0101t\u0101ju sist\u0113m\u0101m, sl\u0113ptas izmai\u0146as netika atkl\u0101tas.<\/p>\n

Piln\u012bb\u0101 izsl\u0113gt veiksm\u012bga uzbrukuma izdar\u012b\u0161anu ne\u013cauj inform\u0101cijas tr\u016bkums par izejo\u0161ajiem t\u012bkla savienojumiem, da\u017e\u0101du \u017eurn\u0101lu dz\u0113\u0161ana pie rot\u0101cijas (piem\u0113ram, cron \u017eurn\u0101la) un nepietiekama detaliz\u0101cija t\u012bmek\u013ca servera \u017eurn\u0101los (veiksm\u012bga eksploit\u0101cija, kas noved pie neatik\u0161anos, netiek iek\u013cauta \u017eurn\u0101l\u0101).
\nVeiksm\u012bgas uzbrukuma gad\u012bjum\u0101 uzbruc\u0113ji var\u0113ja ieg\u016bt piek\u013cuvi datu b\u0101zei ar inform\u0101ciju par visiem GitLab lietot\u0101jiem (parole\u0161u hashi, e-pasti, IP adreses<\/a> utt.), vides main\u012bgajiem un tokeniem no nep\u0101rtrauktas integr\u0101cijas sist\u0113m\u0101m, divu faktoru autentifik\u0101cijas kodiem, person\u012bgo piek\u013cuves tokenu hashiem, priv\u0101to repozitoriju saturam un konfidenci\u0101lu probl\u0113mu apsprie\u017eu. Atkl\u0101tie digit\u0101lo parakstu veido\u0161anai nepiecie\u0161amie atsl\u0113gas uzbrukuma serveri<\/a> netika glab\u0101ti.<\/p>\n

Pirmie m\u0113\u0123in\u0101jumi izmantot neaizsarg\u0101t\u012bbu tika fiks\u0113ti 20. un 21. oktobr\u012b. Uzbruc\u0113js re\u0123istr\u0113ja kontu GitLab un m\u0113\u0123in\u0101ja nos\u016bt\u012bt modific\u0113tus nep\u0101rtraukt\u0101s integr\u0101cijas sist\u0113mas iestat\u012bjumus. \u017durn\u0101los tika fiks\u0113ti 8 av\u0101rijas gad\u012bjumi GitLab darba procesos, no kuriem 4 bija saist\u012bti ar eksploit\u0101cijas lieto\u0161anu. Atz\u012bm\u0113ts, ka pirm\u0101 eksploit\u0101cijas f\u0101ze bija veiksm\u012bga, bet otr\u0101 f\u0101ze beidz\u0101s ar k\u013c\u016bdu.<\/p>\n

Uzbrukuma br\u012bd\u012b konteiner\u012b tika izmantota neaizsarg\u0101ta GitLab versija 19.3.4, kas 22. oktobr\u012b tika atjaunin\u0101ta uz GitLab 19.3.6. Tom\u0113r Alpine administrators \u0146\u0113ma v\u0113r\u0101 to, ka labojums tika veikts tikai ofici\u0101lajos GitLab 19.3.6 instal\u0101cijas pakotn\u0113s, nevis pa\u0161\u0101 GitLab kod\u0101, jo neaizsarg\u0101t\u012bba bija Ruby r\u012bku komplekt\u0101. Konteinera lieto\u0161an\u0101 palika vecais Ruby r\u012bku komplekts, un neaizsarg\u0101t\u012bba palika neatrisin\u0101ta. <\/p>\n

Tas, ka sist\u0113ma paliek neaizsarg\u0101ta, tika konstat\u0113ts tikai 26. oktobr\u012b. \u017durn\u0101lu anal\u012bze par\u0101d\u012bja, ka 25. un 26. oktobr\u012b uzbruc\u0113ji ats\u0101ka m\u0113\u0123in\u0101jumus veikt uzbrukumu. 27. oktobr\u012b tika ierobe\u017eota tre\u0161o personu piek\u013cuve GitLab. 28. oktobr\u012b saturs tika p\u0101rveidots, visi paroli tika atiestat\u012btas (lietot\u0101jiem j\u0101iestata jauna parole, izmantojot aizmirst\u0101s paroles atjauno\u0161anas proced\u016bru), un piek\u013cuves atsl\u0113gas tika nomain\u012btas. 29. oktobr\u012b atjaunin\u0101tais servera<\/a> tika ieviests darb\u012bb\u0101. Docker konteineris alpinelinux\/gitlab palika neaizsarg\u0101ts l\u012bdz 27. oktobrim.
\n
Avots: opennet.lv<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u043c\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (aports). \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 GitLab, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u044f\u0437\u044b\u043a\u0430 Ruby. \u0414\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0438 \u0441\u043b\u0435\u0434\u043e\u0432 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0432\u0437\u043b\u043e\u043c\u0430 \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184064","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Uzbrukums GitLab serverim projekta Alpine Linux | ProHoster","description":"Alpine Linux izstr\u0101d\u0101t\u0101ji izpauda inform\u0101ciju par m\u0113\u0123in\u0101jumiem uzlauzt kop\u012bg\u0101s izstr\u0101des platformu gitlab.alpinelinux.org, kur\u0101 tika str\u0101d\u0101ts pie pakot\u0146u p\u0101rvaldnieka APK, b\u016bvniec\u012bbas r\u012bkiem.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 GitLab-\u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Alpine Linux | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/lv\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-01T09:40:38+00:00","article:modified_time":"2026-11-01T09:40:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/184064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=184064"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/184064\/revisions"}],"predecessor-version":[{"id":184065,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/184064\/revisions\/184065"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=184064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=184064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=184064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}