{"id":184064,"date":"2026-11-01T11:40:38","date_gmt":"2026-11-01T09:40:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataka-na-gitlab-server-proekta-alpine-linux"},"modified":"2026-11-01T11:40:41","modified_gmt":"2026-11-01T09:40:41","slug":"attack-on-alpine-linux-projects-gitlab-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","title":{"rendered":"Napad na GitLab stre\u017enik projekta Alpine Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Razvijalci distribucije Alpine Linux so razkrili informacije o poskusih hekerskega napada na platformo za skupinskega razvijanja gitlab.alpinelinux.org, kjer so potekale aktivnosti na paketnem upravljavcu APK, orodjih za sestavljanje, komponentah infrastrukture in skriptah za sestavljanje paketov (aports). Napad je bil izveden preko izkori\u0161\u010danja ranljivosti v platformi GitLab, ki jo je povzro\u010dilo prenapolnjenje celotnega \u0161tevila v motorju regularnih izrazov jezika Ruby. Dokazov in sledov uspe\u0161nega hekerskega napada ni bilo mogo\u010de najti, vendar pa, ker popolnoma izklju\u010diti uspe\u0161no izkori\u0161\u010danje ranljivosti ni mogo\u010de, je bil kontejner z GitLabom razgla\u0161en za potencialno ogro\u017eenega, vsebina pa je bila popolnoma prenovljena, uporabnikom pa je bila spro\u017eena procedura za spremembo gesel.<\/p>\n

Administratorji infrastrukture Alpine Linux niso odkrili prisotnosti nepoobla\u0161\u010denih datotek, suma o zagonu nenavadnih procesov, nenavadnih dostopov do API, sprememb v nastavitvah in sistemskih datotekah ter nenadnih skokov obremenitve, zna\u010dilnih za mno\u017ei\u010dno pridobivanje podatkov. V postopku analize celovitosti repozitorija aports, paketov in datotek z razli\u010dicami, ter njihove primerjave s kopijami z zunanjih stre\u017enikov za sestavljanje in sistemov razvijalcev, skritih sprememb niso na\u0161li.<\/p>\n

Popolnoma izklju\u010diti uspe\u0161no izvedbo napada ne omogo\u010da pomanjkanje informacij o odhodnih omre\u017enih povezavah, izbris nekaterih logotipov pri rotaciji (na primer loga cron-a) in pomanjkanje ustrezne podrobnosti v logih spletnega stre\u017enika (uspe\u0161na uporaba exploita, ki ne vodi do nenadnega konca, se ne odra\u017ea v logu).
\nV primeru uspe\u0161nega napada bi hekerji lahko pridobili dostop do DB z informacijami o vseh uporabnikih GitLab (hashi gesel, email, IP-naslove<\/a> itd.), spremenljivkami okolja in \u017eetoni iz sistemov za neprekinjeno integracijo, kodami dvofaktorske avtentikacije, hashi osebnih \u017eetonov dostopa, vsebino zasebnih repozitorijev in zaupno razpravo o te\u017eavah. Klju\u010di za ustvarjanje digitalnih podpisov za razli\u010dice in pakete na napadenem stre\u017enikom<\/a> niso bili shranjeni.<\/p>\n

Prvi poku\u0161aji iskori\u0161tavanja ranjivosti zabilje\u017eeni su 20. i 21. oktobra. Napada\u010d je registrovao nalog na GitLabu i poku\u0161ao je poslati modificirane postavke sistema kontinuirane integracije. U logovima je zabilje\u017eeno 8 hitnih zavr\u0161etaka radnih procesa GitLab-a, od \u010dega su 4 povezana s primjenom exploit-a. Isti\u010de se da je prva faza rada exploit-a bila uspje\u0161na, ali je druga faza zavr\u0161ila neuspje\u0161no.<\/p>\n

U trenutku napada, u kontejneru je kori\u0161\u0107ena ranjiva verzija GitLab 19.3.4, koja je 22. oktobra a\u017eurirana na izdanja GitLab 19.3.6. Me\u0111utim, administratori Alpine-a nisu uzeli u obzir da je ispravka unesena samo u zvani\u010dne instalacione pakete GitLab 19.3.6, a ne u sam kod GitLab-a, jer ranjivost postoji u Ruby alatu. U kontejneru je i dalje kori\u0161\u0107en stari Ruby alat i ranjivost je ostala neispravljena. <\/p>\n

To \u0161to sistem ostaje ranjivim otkriveno je tek 26. oktobra. Analiza logova pokazala je da su 25. i 26. oktobra napada\u010di ponovo zapo\u010deli poku\u0161aje napada. 27. oktobra pristup spoljnih korisnika GitLab-u je ograni\u010den. 28. oktobra sadr\u017eaj je rekonstruisan, sve \u0161ifre su resetovane (korisnicima je potrebno da postave novu \u0161ifru putem procedure za oporavak zaboravljene \u0161ifre), a pristupni klju\u010devi su zamenjeni. 29. oktobra a\u017eurirani stre\u017enik<\/a> je pu\u0161ten u rad. Prate\u0107i projekat Docker kontejner alpinelinux\/gitlab ostao je ranjiv sve do 27. oktobra.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u043c\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (aports). \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 GitLab, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u044f\u0437\u044b\u043a\u0430 Ruby. \u0414\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0438 \u0441\u043b\u0435\u0434\u043e\u0432 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0432\u0437\u043b\u043e\u043c\u0430 \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184064","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Napad na GitLab server projekta Alpine Linux | ProHoster","description":"Razvija\u010di distribucije Alpine Linux otkrili su informacije o poku\u0161ajima hakovanja platforme za zajedni\u010dki rad gitlab.alpinelinux.org, na kojoj se radilo na upravitelju paketa APK, alatima za izgradnju.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 GitLab-\u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Alpine Linux | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/sl\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-01T09:40:38+00:00","article:modified_time":"2026-11-01T09:40:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/184064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=184064"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/184064\/revisions"}],"predecessor-version":[{"id":184065,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/184064\/revisions\/184065"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=184064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=184064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=184064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}