Gitlab servers are being exploited in DDoS attacks
therecord.media
Gitlab servers are being exploited in DDoS attacks
1–10 of 177 posts
Re: Gitlab servers are being exploited in DDoS attacks
#2This happened to all Gitlab instances that I manage around 2 days ago. Good to see publicity, I’m still dealing with not-so-understanding abuse departments at my hosting providers.
Sure, my fault for not keeping it up to date. But there is much noise to filter through in the many tools we juggle these days, especially if an organization prefers to self-host.
Re: Gitlab servers are being exploited in DDoS attacks
#3"..Bowling said he discovered a way to abuse how ExifTool handles uploads for DjVu file format used for scanned documents to gain control over the entire underlying GitLab web server"
Ah, the good old "File upload vulnerability". File uploads remain one of the hardest problems to solve when it comes to security.
Re: Gitlab servers are being exploited in DDoS attacks
#4[deleted]
Re: Gitlab servers are being exploited in DDoS attacks
#5This happened to all Gitlab instances that I manage around 2 days ago. Good to see publicity, I’m still dealing with not-so-understanding abuse departments at my hosting providers. Sure, my fault for not keeping it up to date. But there is much noise to filter through in the many tools we juggle these days, especially if an organization prefers to self-host.
Article said GitLab patched back in April. Safe to say you didn’t deploy these patches?
No judgment. I’m paid to make things, not apply patches. This is however why I don’t use self-hosted, pros and cons, etc.
Re: Gitlab servers are being exploited in DDoS attacks
#6As the exploit requires uploading a file, is it required for the attacker to first have a user account with file upload permissions?
Re: Gitlab servers are being exploited in DDoS attacks
#7"..Bowling said he discovered a way to abuse how ExifTool handles uploads for DjVu file format used for scanned documents to gain control over the entire underlying GitLab web server" Ah, the good old "File upload vulnerability". File uploads remain one of the hardest problems to solve when it comes to security.
Is that because people use hackjob dependencies to handle it more often than not?
Re: Gitlab servers are being exploited in DDoS attacks
#8As the exploit requires uploading a file, is it required for the attacker to first have a user account with file upload permissions?
Anyone who can open issues in a repo I think
Re: Gitlab servers are being exploited in DDoS attacks
#9"..Bowling said he discovered a way to abuse how ExifTool handles uploads for DjVu file format used for scanned documents to gain control over the entire underlying GitLab web server" Ah, the good old "File upload vulnerability". File uploads remain one of the hardest problems to solve when it comes to security.
Is that because people use hackjob dependencies to handle it more often than not?
ExifTool is hackjob? I think not.
But also, file uploads should be handled in a jail or box of some type - and never let their analysis make network calls.
Re: Gitlab servers are being exploited in DDoS attacks
#10From the issue report[1] comments:
> Thanks in no small part to your recent findings, [GitLab] are rolling back our policy about paying half-bounties for third party findings. These have great impact on GitLab and we want to continue to incentivize research for high+ severity issues in that area.
At least they're taking these things a bit more seriously now.