{"id":184064,"date":"2026-11-01T11:40:38","date_gmt":"2026-11-01T09:40:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/ataka-na-gitlab-server-proekta-alpine-linux"},"modified":"2026-11-01T11:40:41","modified_gmt":"2026-11-01T09:40:41","slug":"attack-on-alpine-linux-projects-gitlab-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","title":{"rendered":"Sulmi n\u00eb serverin GitLab t\u00eb projektit Alpine Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Zhvilluesit e distribucionit Alpine Linux zbuluan informacion rreth p\u00ebrpjekjeve p\u00ebr t\u00eb hyr\u00eb n\u00eb platform\u00ebn e zhvillimit t\u00eb p\u00ebrbashk\u00ebt gitlab.alpinelinux.org, ku po punohej mbi menaxherin e paketave APK, mjetet nd\u00ebrtuese, komponent\u00ebt e infrastruktur\u00ebs dhe skriptet p\u00ebr nd\u00ebrtimin e pakove (aports). Sulmi u krye p\u00ebrmes shfryt\u00ebzimit t\u00eb nj\u00eb vulnerabiliteti n\u00eb platform\u00ebn GitLab, t\u00eb shkaktuar nga mbipopullimi i numrave t\u00eb plot\u00eb n\u00eb motorin e shprehjeve t\u00eb rregullta t\u00eb gjuh\u00ebs Ruby. Nuk u gjet\u00ebn prova dhe shenja t\u00eb nj\u00eb hacks t\u00eb suksessh\u00ebm, por pasi q\u00eb p\u00ebrjashtimi i plot\u00eb i shfryt\u00ebzimit t\u00eb suksessh\u00ebm t\u00eb vulnerabilitetit \u00ebsht\u00eb i pamundur, kontejneri me GitLab u shpall potencialisht i komprometuar dhe p\u00ebrmbajtja e tij u rinovua nga zero, nd\u00ebrsa p\u00ebrdoruesit filluan procedur\u00ebn e nd\u00ebrrimit t\u00eb fjal\u00ebkalimeve.<\/p>\n

Administrator\u00ebt e infrastruktur\u00ebs Alpine Linux nuk zbuluan shfaqjen e skedave t\u00eb huaja, procese t\u00eb dyshimta t\u00eb aktivizuara, k\u00ebrkesa t\u00eb \u00e7uditshme n\u00eb API, ndryshime n\u00eb cil\u00ebsimet dhe skedat sistemore, si dhe rritje t\u00eb ngarkes\u00ebs q\u00eb jan\u00eb karakteristike p\u00ebr nxjerrjen masive t\u00eb t\u00eb dh\u00ebnave. Gjat\u00eb analiz\u00ebs s\u00eb integritetit t\u00eb depozit\u00ebs aports, paketave dhe skedave me l\u00ebshime, si dhe p\u00ebrputhjes s\u00eb tyre me kopjet nga serverat e jasht\u00ebm t\u00eb nd\u00ebrtimit dhe sistemet e zhvilluesve, nuk u zbuluan ndryshime t\u00eb fshehura.<\/p>\n

P\u00ebrjashtimi i plot\u00eb i nj\u00eb sulmi t\u00eb suksessh\u00ebm nuk lejohet nga mungesa e informacionit mbi lidhjet e jashtme t\u00eb rrjetit, fshirjen e disa regjistrave gjat\u00eb rotacionit (p.sh., regjistri i cron-it) dhe munges\u00ebn e detajimit t\u00eb duhur n\u00eb regjistrat e serverit web (aplikimi i suksessh\u00ebm i nj\u00eb eksploiti, q\u00eb nuk rezulton n\u00eb mbyllje emergjente, nuk shfaqet n\u00eb regjist\u00ebr).
\nN\u00eb rast t\u00eb nj\u00eb sulmi t\u00eb suksessh\u00ebm, sulmuesit mund t\u00eb kishin qasje n\u00eb DB me t\u00eb dh\u00ebnat p\u00ebr t\u00eb gjith\u00eb p\u00ebrdoruesit e GitLab (hash-et e fjal\u00ebkalimeve, email, Adresa IP<\/a> etj.), variablat e ambientit dhe tokenet nga sistemet e integrimit t\u00eb vazhduesh\u00ebm, kodet e dyfisht\u00eb t\u00eb autentikimit, hash-et e tokeneve personale t\u00eb aksesit, p\u00ebrmbajtjen e depozitave t\u00eb privata dhe diskutimet konfidenciale t\u00eb problemeve. \u00c7el\u00ebsat p\u00ebr formimin e n\u00ebnshkrimeve digjitale p\u00ebr l\u00ebshimet dhe paketat n\u00eb t\u00eb sulmuar\u00ebn server<\/a> nuk u ruajt\u00ebn.<\/p>\n

P\u00ebrpjekjet e para p\u00ebr t\u00eb shfryt\u00ebzuar dob\u00ebsin\u00eb u regjistruan m\u00eb 20 dhe 21 tetor. Sulmuesi regjistroi nj\u00eb llogari n\u00eb GitLab dhe p\u00ebrpiqej t\u00eb d\u00ebrgonte konfigurime t\u00eb modifikuara p\u00ebr sistemin e integrimit t\u00eb vazhduesh\u00ebm. N\u00eb loge u regjistruan 8 p\u00ebrfundime fatale t\u00eb proceseve t\u00eb GitLab, nga t\u00eb cilat 4 ishin t\u00eb lidhura me p\u00ebrdorimin e exploit-it. Sh\u00ebnohet se faza e par\u00eb e pun\u00ebs s\u00eb exploit-it ishte e suksesshme, por faza e dyt\u00eb p\u00ebrfundoi me d\u00ebshtim.<\/p>\n

N\u00eb momentin e sulmit, n\u00eb konteiner po p\u00ebrdorej versioni i dob\u00ebt GitLab 19.3.4, i cili m\u00eb 22 tetor u p\u00ebrdit\u00ebsua n\u00eb l\u00ebshimin GitLab 19.3.6. Por administrator\u00ebt e Alpine nuk e kishin marr\u00eb parasysh se riparimi ishte b\u00ebr\u00eb vet\u00ebm n\u00eb paketat instalimi zyrtare t\u00eb GitLab 19.3.6 dhe jo n\u00eb kodin e vet GitLab, pasi dob\u00ebsia ishte e pranishme n\u00eb mjetin Ruby. N\u00eb konteiner vazhdoi t\u00eb p\u00ebrdorej nj\u00eb mjet i vjet\u00ebr Ruby dhe dob\u00ebsia mbeti e pa riparuar. <\/p>\n

Fakti q\u00eb sistemi mbetet i dob\u00ebt u identifikua vet\u00ebm m\u00eb 26 tetor. Analiza e logeve tregoi se m\u00eb 25 dhe 26 tetor sulmuesit rinis\u00ebn p\u00ebrpjekjet p\u00ebr t\u00eb kryer sulmin. M\u00eb 27 tetor, akseset e p\u00ebrdoruesve t\u00eb jasht\u00ebm n\u00eb GitLab u kufizuan. M\u00eb 28 tetor, p\u00ebrmbajtja u rind\u00ebrtua, t\u00eb gjitha fjal\u00ebkalimet u rivendos\u00ebn (p\u00ebrdoruesit duhet t\u00eb vendosin nj\u00eb fjal\u00ebkalim t\u00eb ri p\u00ebrmes procedur\u00ebs s\u00eb rikuperimit t\u00eb fjal\u00ebkalimit t\u00eb harruar), dhe \u00e7el\u00ebsat e aksesit u z\u00ebvend\u00ebsuan. M\u00eb 29 tetor, versioni i ri server<\/a> u vendos n\u00eb funksion. Projekti i bazuar n\u00eb konteinerin Docker alpinelinux\/gitlab mbeti i dob\u00ebt deri m\u00eb 27 tetor.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438, \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430\u043c\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u0441\u043a\u0440\u0438\u043f\u0442\u0430\u043c\u0438 \u0441\u0431\u043e\u0440\u043a\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 (aports). \u0410\u0442\u0430\u043a\u0430 \u0431\u044b\u043b\u0430 \u0441\u043e\u0432\u0435\u0440\u0448\u0435\u043d\u0430 \u0447\u0435\u0440\u0435\u0437 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 GitLab, \u0432\u044b\u0437\u0432\u0430\u043d\u043d\u043e\u0439 \u0446\u0435\u043b\u043e\u0447\u0438\u0441\u043b\u0435\u043d\u043d\u044b\u043c \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u044f\u0437\u044b\u043a\u0430 Ruby. \u0414\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432 \u0438 \u0441\u043b\u0435\u0434\u043e\u0432 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0432\u0437\u043b\u043e\u043c\u0430 \u043d\u0430\u0439\u0442\u0438 \u043d\u0435 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-184064","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sulmi mbi serverin GitLab t\u00eb projektit Alpine Linux | ProHoster","description":"Zhvilluesit e distribucionit Alpine Linux zbuluan informacionin mbi p\u00ebrpjekjet p\u00ebr t\u00eb thyer platform\u00ebn e zhvillimit t\u00eb p\u00ebrbashk\u00ebt gitlab.alpinelinux.org, ku po punoheshin mbi menaxherin e paketave APK dhe mjete nd\u00ebrtimi.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 GitLab-\u0441\u0435\u0440\u0432\u0435\u0440 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Alpine Linux | ProHoster","og:description":"\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430 Alpine Linux \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u0432\u0437\u043b\u043e\u043c\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0441\u043e\u0432\u043c\u0435\u0441\u0442\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 gitlab.alpinelinux.org, \u043d\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0432\u0435\u043b\u0430\u0441\u044c \u0440\u0430\u0431\u043e\u0442\u0430 \u043d\u0430\u0434 \u043f\u0430\u043a\u0435\u0442\u043d\u044b\u043c \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440\u043e\u043c APK, \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u043c\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/attack-on-alpine-linux-projects-gitlab-server","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-11-01T09:40:38+00:00","article:modified_time":"2026-11-01T09:40:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/184064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=184064"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/184064\/revisions"}],"predecessor-version":[{"id":184065,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/184064\/revisions\/184065"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=184064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=184064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=184064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}