Gitlab servers are being exploited in DDoS attacks

Post by john_cogs » Fri, Nov 05, 2021, 11:34 AM UTC

thepill wrote: post #150

KronisLV wrote: post #130

I feel like this article could have been far more useful with the following points being explicitly mentioned, or at least summarized: - the problem appeared in GitLab 11.9.0 - the problem seems to have been fixed in GitLab 13.8.8 - the vulnerability uses ExifTool, so to exploit it, a user needs to be able to upload images - if an update is not (yet) possible, DjVu format file uploads can be blocked to avert this vul…

How do you check if you have been compromised? I did apply the patch a few days after it was released, but im unsure if the system has been compromised....

Post by aasasd » Fri, Nov 05, 2021, 11:44 AM UTC

beefield wrote: post #125

Jach wrote: post #41

It's somewhat refreshing that the underlying bug isn't from some C or C++ utility, but instead a Perl program using eval: https://github.com/exiftool/exiftool/blob/11.70/lib/Image/Ex... Another instance of "avoid eval as much as possible" for languages that have it.

Okay, I'll bite. I have known for a long time that eval is evil. Then, last year I actually needed to evaluate a string (from a file). As the case was safe enough (input 100% controlled by me), I did not worry too much and just used eval. But what would be a safe way to evaluate things if you needed to do that in unsafe environment? Say, you would like to make a safe website that allows user type a python code snippe…

Post by deepsun » Fri, Nov 05, 2021, 12:02 PM UTC

aasasd wrote: post #152

deepsun wrote: post #144

Earlier quoted context omitted.

In Eastern Europe professors share scanned books/papers mostly in .djvu format.

Which afaik amounts in that case to a bunch of grayscale JPEGs. Dunno about other cases, but I've never seen a djvu with extra capabilities besides raster images of the pages.

Post by franga2000 » Fri, Nov 05, 2021, 12:06 PM UTC

beefield wrote: post #125

Jach wrote: post #41

It's somewhat refreshing that the underlying bug isn't from some C or C++ utility, but instead a Perl program using eval: https://github.com/exiftool/exiftool/blob/11.70/lib/Image/Ex... Another instance of "avoid eval as much as possible" for languages that have it.

Okay, I'll bite. I have known for a long time that eval is evil. Then, last year I actually needed to evaluate a string (from a file). As the case was safe enough (input 100% controlled by me), I did not worry too much and just used eval. But what would be a safe way to evaluate things if you needed to do that in unsafe environment? Say, you would like to make a safe website that allows user type a python code snippe…

Post by morelisp » Fri, Nov 05, 2021, 12:20 PM UTC

magicalhippo wrote: post #146

KronisLV wrote: post #130

I feel like this article could have been far more useful with the following points being explicitly mentioned, or at least summarized: - the problem appeared in GitLab 11.9.0 - the problem seems to have been fixed in GitLab 13.8.8 - the vulnerability uses ExifTool, so to exploit it, a user needs to be able to upload images - if an update is not (yet) possible, DjVu format file uploads can be blocked to avert this vul…

> if an update is not (yet) possible, DjVu format file uploads can be blocked to avert this vulnerability Note that the issue was enabled by GitLab not verify the file format, ie that a .jpg is a JPEG and not a DjVu file for example, before handing it over to ExifTool. So a simple extension/mime check won't cut it.