{"id":144091,"date":"2025-10-03T23:11:58","date_gmt":"2025-10-03T21:11:58","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vzlom-vnutrennego-gitlab-servera-red-hat"},"modified":"2025-10-03T23:11:58","modified_gmt":"2025-10-03T21:11:58","slug":"vzlom-vnutrennego-gitlab-servera-red-hat","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/vzlom-vnutrennego-gitlab-servera-red-hat","title":{"rendered":"Hakerstwo wewn\u0119trznego serwera GitLab Red Hat","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Grupa hakerska Crimson Collective og\u0142osi\u0142a, \u017ce uzyska\u0142a dost\u0119p do jednego z wewn\u0119trznych serwer\u00f3w GitLab firmy Red Hat i pobra\u0142a z niego 570 GB skompresowanych danych, kt\u00f3re zawieraj\u0105 informacje z 28 tysi\u0119cy repozytori\u00f3w. W\u015br\u00f3d zebranych danych znajdowa\u0142o si\u0119 oko\u0142o 800 raport\u00f3w CER (Customer Engagement Report), zawieraj\u0105cych poufne informacje o platformach i infrastrukturze sieciowej klient\u00f3w Red Hat, kt\u00f3rym \u015bwiadczono us\u0142ugi doradcze. <\/p>\n

W przedstawionych przez atakuj\u0105cych zrzutach ekranu i przyk\u0142adach wspomniano o uzyskaniu danych dotycz\u0105cych oko\u0142o 800 klient\u00f3w Red Hat, w\u015br\u00f3d kt\u00f3rych znajduj\u0105 si\u0119 Vodafone, T-Mobile, Siemens, Boeing, Bosch, 3M, Cisco, DHL, Adobe, American Express, Verizon, JPMC, HSBC, Ericsson, Merrick Bank, Telefonica, Bank of America, Delta Air Lines, Walmart, Kaiser, IBM, SWIFT, IKEA oraz AT&T, a tak\u017ce Centrum Rozwoju Broni Nawodnej Marynarki Wojennej USA, Federalna Administracja Lotnictwa Cywilnego USA, Federalna Agencja Zarz\u0105dzania Kryzysowego USA, Si\u0142y Powietrzne USA, Agencja Bezpiecze\u0144stwa Narodowego USA, Urz\u0105d Patentowy i Znak\u00f3w Towarowych USA, Senat USA oraz Izba Reprezentant\u00f3w USA. <\/p>\n

Podano, \u017ce przej\u0119te repozytoria zawieraj\u0105 informacje o infrastrukturze klient\u00f3w, konfiguracj\u0119, tokeny uwierzytelniaj\u0105ce, profile VPN<\/a>, dane inwentarzowe, Ansible playbook, konfiguracje platformy OpenShift, runner-y CI\/CD, kopie zapasowe oraz inne dane, kt\u00f3re mog\u0105 by\u0107 wykorzystane do przeprowadzenia ataku na wewn\u0119trzne sieci klient\u00f3w. Cyberprzest\u0119pcy pr\u00f3bowali skontaktowa\u0107 si\u0119 z Red Hat w celu wymuszenia, ale otrzymali jedynie standardow\u0105 odpowied\u017a z propozycj\u0105 przes\u0142ania raportu o podatno\u015bci do dzia\u0142u bezpiecze\u0144stwa. <\/p>\n

Firma Red Hat potwierdzi\u0142a incydent zwi\u0105zany z bezpiecze\u0144stwem, ale nie przedstawi\u0142a szczeg\u00f3\u0142\u00f3w ani nie skomentowa\u0142a informacji na temat zawarto\u015bci wycieku. Wspomniano jedynie, \u017ce zhakowany serwer GitLab by\u0142 wykorzystywany w jednostce doradczej i firma podj\u0119\u0142a niezb\u0119dne kroki w celu przeprowadzenia dochodzenia i przywr\u00f3cenia. Przedstawiciele Red Hat twierdz\u0105, \u017ce nie maj\u0105 podstaw, aby s\u0105dzi\u0107, \u017ce w\u0142amanie dotkn\u0119\u0142o inne us\u0142ugi i produkty firmy, poza jednym serwera<\/a> GitLab. <\/p>\n

Uzupe\u0142nienie: Firma Red Hat opublikowa\u0142a wst\u0119pny raport dotycz\u0105cy incydentu. W raporcie brak szczeg\u00f3\u0142\u00f3w; jedynie zaznaczono, \u017ce firma rozpocz\u0119\u0142a \u015bledztwo, w trakcie kt\u00f3rego ustalono, \u017ce nieznana osoba uzyska\u0142a dost\u0119p do serwera GitLab, u\u017cywanego do prowadzenia projekt\u00f3w zespo\u0142u Red Hat Consulting, i pobra\u0142a z niego pewne dane. <\/p>\n

W odniesieniu do danych pobranych przez atakuj\u0105cego twierdzi si\u0119, \u017ce zawiera\u0142y one specyfikacje projekt\u00f3w, przyk\u0142ady kodu oraz wewn\u0119trzne materia\u0142y informacyjne dotycz\u0105ce us\u0142ug konsultingowych. Na obecnym etapie analizy incydentu nie zidentyfikowano wycieku wa\u017cnych danych osobowych. <\/p>\n

Nie wyszczeg\u00f3lniono, w jaki spos\u00f3b atakuj\u0105cy uzyska\u0142 dost\u0119p do serwera GitLab, ale zaznaczono, \u017ce w ataku nie wykorzystano wczoraj wykrytej luki (CVE-2025-10725) w OpenShift AI Service, kt\u00f3ra pozwala\u0142a uwierzytelnionemu u\u017cytkownikowi bez uprawnie\u0144, na przyk\u0142ad badaczowi u\u017cywaj\u0105cemu notatnik Jupyter, uzyska\u0107 prawa administratora klastra, maj\u0105cego pe\u0142ny dost\u0119p do wszystkich us\u0142ug, danych oraz uruchamianych w klastrze aplikacji, a tak\u017ce dost\u0119p do root na w\u0119z\u0142ach klastra.
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0425\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 Crimson Collective \u0437\u0430\u044f\u0432\u0438\u043b\u0430 \u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 GitLab-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Red Hat \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0441 \u043d\u0435\u0433\u043e 570\u0413\u0411 \u0441\u0436\u0430\u0442\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 28 \u0442\u044b\u0441\u044f\u0447 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432. \u0421\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e \u0432 \u0437\u0430\u0445\u0432\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u043e \u043e\u043a\u043e\u043b\u043e 800 CER-\u043e\u0442\u0447\u0451\u0442\u043e\u0432 (Customer Engagement Report), \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 Red Hat, \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0438\u0441\u044c \u043a\u043e\u043d\u0441\u0430\u043b\u0442\u0438\u043d\u0433\u043e\u0432\u044b\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-144091","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Hakerski atak na wewn\u0119trzny serwer GitLab Red Hat | ProHoster","description":"Grupa hakerska Crimson Collective og\u0142osi\u0142a, \u017ce uzyska\u0142a dost\u0119p do jednego z wewn\u0119trznych serwer\u00f3w GitLab firmy Red Hat i pobra\u0142a z niego 570 GB skompresowanych danych, zawieraj\u0105cych informacje z 28 tysi\u0119cy repozytori\u00f3w.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/vzlom-vnutrennego-gitlab-servera-red-hat","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u0437\u043b\u043e\u043c \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0433\u043e GitLab-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Red Hat | ProHoster","og:description":"\u0425\u0430\u043a\u0435\u0440\u0441\u043a\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 Crimson Collective \u0437\u0430\u044f\u0432\u0438\u043b\u0430 \u043e \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 GitLab-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Red Hat \u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435 \u0441 \u043d\u0435\u0433\u043e 570\u0413\u0411 \u0441\u0436\u0430\u0442\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u0437 28 \u0442\u044b\u0441\u044f\u0447 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/vzlom-vnutrennego-gitlab-servera-red-hat","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2025-10-03T21:11:58+00:00","article:modified_time":"2025-10-03T21:11:58+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"144091","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-22 15:54:02","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-01-23 15:06:19","updated":"2026-02-22 15:54:02","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/144091","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=144091"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/144091\/revisions"}],"predecessor-version":[{"id":162511,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/144091\/revisions\/162511"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=144091"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=144091"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=144091"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}