{"id":184064,"date":"2026-11-01T11:40:38","date_gmt":"2026-11-01T09:40:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataka-na-gitlab-server-proekta-alpine-linux"},"modified":"2026-11-01T11:40:41","modified_gmt":"2026-11-01T09:40:41","slug":"attack-on-alpine-linux-projects-gitlab-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","title":{"rendered":"Atac asupra serverului GitLab al proiectului Alpine Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Dezvoltatorii distribu\u021biei Alpine Linux au dezv\u0103luit informa\u021bii despre tentativa de hacking a platformei de colaborare gitlab.alpinelinux.org, pe care se lucra la managerul de pachete APK, uneltele de compilare, componentele infrastructurii \u0219i scripturile de compilare a pachetelor (aports). Atacul a fost efectuat prin exploatarea unei vulnerabilit\u0103\u021bi \u00een platforma GitLab, cauzat\u0103 de o dep\u0103\u0219ire a valorii \u00eentregi \u00een motorul de expresii regulate al limbajului Ruby. Nu s-au g\u0103sit dovezi sau urme ale unei bre\u0219e reu\u0219ite, dar, deoarece nu se poate exclude complet exploatarea cu succes a vulnerabilit\u0103\u021bii, containerul cu GitLab a fost considerat poten\u021bial compromis \u0219i con\u021binutul s\u0103u a fost reconstruit complet de la zero, iar utilizatorilor li s-a ini\u021biat procedura de schimbare a parolelor.<\/p>\n

Administratorii infrastructurii Alpine Linux nu au identificat apari\u021bia fi\u0219ierelor externe, procese suspecte \u00een execu\u021bie, apeluri neobi\u0219nuite la API, modific\u0103ri ale set\u0103rilor \u0219i fi\u0219ierelor de sistem, precum \u0219i cre\u0219teri ale \u00eenc\u0103rc\u0103rii specifice extragerii masive de date. \u00cen timpul analizei integrit\u0103\u021bii repository-ului aports, pachetelor \u0219i fi\u0219ierelor de release, precum \u0219i a verific\u0103rii acestora cu copiile de pe serverele externe de compilare \u0219i sistemele dezvoltatorilor, nu s-au descoperit modific\u0103ri ascunse.<\/p>\n

Excluderea complet\u0103 a unui atac reu\u0219it este imposibil\u0103 din cauza lipsei de informa\u021bii despre conexiunile re\u021belei externe, \u0219tergerea unor loguri \u00een timpul rot\u0103rii (de exemplu, logul cron) \u0219i absen\u021ba detaliilor adecvate \u00een logurile serverului web (aplicarea cu succes a exploit-ului care nu duce la o \u00eentrerupere brusc\u0103 nu este reflectat\u0103 \u00een log).
\n\u00cen cazul unui atac reu\u0219it, atacatorii ar fi putut ob\u021bine acces la baza de date cu informa\u021bii despre to\u021bi utilizatorii GitLab (hash-uri de parole, email, adrese IP<\/a> \u0219i altele), variabile de mediu \u0219i token-uri din sistemele de integrare continu\u0103, coduri de autentificare \u00een doi pa\u0219i, hash-uri ale token-urilor personale de acces, con\u021binutul repository-urilor private \u0219i discu\u021biile confiden\u021biale despre probleme. Cheile pentru generarea semn\u0103turilor digitale pentru release-uri \u0219i pachete pe sistemul atacat server<\/a> nu erau stocate.<\/p>\n

Primele \u00eencerc\u0103ri de exploatare a vulnerabilit\u0103\u021bii au fost \u00eenregistrate pe 20 \u0219i 21 octombrie. Atacatorul a \u00eenregistrat un cont \u00een GitLab \u0219i a \u00eencercat s\u0103 trimit\u0103 configura\u021bii modificate pentru sistemul de integrare continu\u0103. \u00cen jurnale au fost \u00eenregistrate 8 finaliz\u0103ri anormale ale proceselor GitLab, dintre care 4 erau legate de aplicarea exploit-ului. Se remarc\u0103 faptul c\u0103 prima faz\u0103 de func\u021bionare a exploit-ului a fost de succes, dar a doua etap\u0103 s-a terminat cu e\u0219ec.<\/p>\n

\u00cen momentul atacului, \u00een container era utilizat\u0103 versiunea vulnerabil\u0103 GitLab 19.3.4, care pe 22 octombrie a fost actualizat\u0103 la versiunea GitLab 19.3.6. \u00cens\u0103, administratorii Alpine nu au \u021binut cont de faptul c\u0103 remedierea a fost inclus\u0103 doar \u00een pachetele oficiale de instalare GitLab 19.3.6, nu \u00een codul GitLab \u00een sine, deoarece vulnerabilitatea era prezent\u0103 \u00een instrumentarul Ruby. \u00cen container continua s\u0103 fie utilizat vechiul instrumentar Ruby \u0219i vulnerabilitatea a r\u0103mas nerezolvat\u0103. <\/p>\n

Faptul c\u0103 sistemul r\u0103m\u00e2ne vulnerabil a fost descoperit abia pe 26 octombrie. Analiza jurnalelor a ar\u0103tat c\u0103 pe 25 \u0219i 26 octombrie atacatorii au reluat \u00eencerc\u0103rile de atac. Pe 27 octombrie, accesul utilizatorilor externi la GitLab a fost restric\u021bionat. Pe 28 octombrie, con\u021binutul a fost recompus, toate parolele au fost resetate (utilizatorii trebuie s\u0103 \u00ee\u0219i stabileasc\u0103 o nou\u0103 parol\u0103 prin procedura de recuperare a parolei uitate), iar cheile de acces au fost \u00eenlocuite. Pe 29 octombrie, noul serverul<\/a> a fost pus \u00een func\u021biune. Proiectul Docker-container al alpinelinux\/gitlab a r\u0103mas vulnerabil p\u00e2n\u0103 pe 27 octombrie.
\n
Sursa: opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u043c\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (aports). \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 GitLab, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u044f\u0437\u044b\u043a\u0430 Ruby. \u0414\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0438 \u0441\u043b\u0435\u0434\u043e\u0432 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0432\u0437\u043b\u043e\u043c\u0430 \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184064","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atacul asupra serverului GitLab al proiectului Alpine Linux | ProHoster","description":"Dezvoltatorii distribu\u021biei Alpine Linux au dezv\u0103luit informa\u021bii despre \u00eencerc\u0103rile de hacking ale platformei de colaborare gitlab.alpinelinux.org, pe care se lucra la managerul de pachete APK \u0219i instrumentele de construire.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 GitLab-\u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Alpine Linux | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-01T09:40:38+00:00","article:modified_time":"2026-11-01T09:40:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/184064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=184064"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/184064\/revisions"}],"predecessor-version":[{"id":184065,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/184064\/revisions\/184065"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=184064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=184064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=184064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}