Gitlab servers are being exploited in DDoS attacks

Post by mdoms » Fri, Nov 05, 2021, 2:27 AM UTC

Gigachad wrote: post #65

Someone1234 wrote: post #38

Earlier quoted context omitted.

> But there is much noise to filter through in the many tools we juggle these days, especially if an organization prefers to self-host. If an organization is too overloaded to patch for six months, maybe they should re-evaluate if self-hosting is the best course of action. Seems like this is a foot-gun of your own creation.

There is very little reason to even self host Gitlab unless you are insanely paranoid or for philosophy reasons like debian/gnome.

Post by danudey » Fri, Nov 05, 2021, 2:32 AM UTC

jacquesm wrote: post #42

seph-reed wrote: post #11

Earlier quoted context omitted.

> File uploads remain one of the hardest problems to solve when it comes to security. Why? It seems like they should have read/write but no execute. What goes wrong?

You essentially have a gateway into a very large chunk of code that was most likely not built with security in mind on the parsing side, on top of that you are guaranteed write access to some file system.

Post by justin_oaks » Fri, Nov 05, 2021, 2:38 AM UTC

Gigachad wrote: post #66

charcircuit wrote: post #49

Earlier quoted context omitted.

Not him, but how are you supposed to know about the update? Do you need to check some page every day if there's an update? Why can't security updates just autoupdate like apps on phones or at least email the admin saying there is an important update.

Yes, you are meant to be paying attention to the security news for all tools you self host. That's part of self hosting. If you can't manage that (which is completely fair), then you shouldn't be self hosting.

Post by david2ndaccount » Fri, Nov 05, 2021, 2:48 AM UTC

mxrlkn wrote: post #88

winrid wrote: post #54

Earlier quoted context omitted.

My personal career favorite use of eval was for an import system that "unrolled" the loop that went through the columns for each row, using eval. It was much faster, but obviously a huge security risk. Today with modern JIT compilers its probably not much faster...

I was once tasked with creating a new frontend on an old project that had an API endpoint return something like this: var array = ["foo", "bar"] I was expecting xml or json (like the rest of the endpoints), but I realized that they just served this as text, and then eval'd it on the frontend...

Post by ceochronos » Fri, Nov 05, 2021, 2:52 AM UTC

mattbee wrote: post #16

nielsole wrote: post #8

Earlier quoted context omitted.

Anyone who can open issues in a repo I think

I am confused by this right now. I built a self-hosted gitlab install years ago for my own use, turned off sign-up, no public project listings - and still it was compromised. The HackerOne PoC URL throws a sign-in redirect for me, so I'm still trying to work it out.