Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gitlab servers are being exploited in DDoS attacks

therecord.media

Post reply on HN
Print view View original

21–30 of 177 posts

Re: Gitlab servers are being exploited in DDoS attacks

#21

Post by staunch »

henning wrote: post #12

Would putting your Gitlab instance behind a VPN mitigate this issue and similar? At least, it would limit attackers to malicious people with VPN access.

Yes, it would. Most people should put their internal cloud infrastructure behind a VPN, if at all possible. It's easy to do and dramatically reduces the surface area for an attacker.

It's not a silver bullet but in many cases it will be the difference between getting hacked and not getting hacked.

It is totally possible to design applications that can be safely exposed to the public internet but it requires some real effort.

Re: Gitlab servers are being exploited in DDoS attacks

#22

Post by ASalazarMX »

seph-reed wrote: post #11
codegeek wrote: post #3

"..Bowling said he discovered a way to abuse how ExifTool handles uploads for DjVu file format used for scanned documents to gain control over the entire underlying GitLab web server" Ah, the good old "File upload vulnerability". File uploads remain one of the hardest problems to solve when it comes to security.

> File uploads remain one of the hardest problems to solve when it comes to security. Why? It seems like they should have read/write but no execute. What goes wrong?

The file is not executable, but the parser executes it in its own context:

> When uploading image files, GitLab Workhorse passes any files with the extensions jpg|jpeg|tiff through to ExifTool to remove any non-whitelisted tags.

> An issue with this is that ExifTool will ignore the file extension and try to determine what the file is based on the content, allowing for any of the supported parsers to be hit instead of just JPEG and TIFF by just renaming the uploaded file.

> One of the supported formats is DjVu. When parsing the DjVu annotation, the tokens are evaled to "convert C escape sequences".

https://gitlab.com/gitlab-org/gitlab/-/issues/327121

Re: Gitlab servers are being exploited in DDoS attacks

#23

Post by SahAssar »

seph-reed wrote: post #11
codegeek wrote: post #3

"..Bowling said he discovered a way to abuse how ExifTool handles uploads for DjVu file format used for scanned documents to gain control over the entire underlying GitLab web server" Ah, the good old "File upload vulnerability". File uploads remain one of the hardest problems to solve when it comes to security.

> File uploads remain one of the hardest problems to solve when it comes to security. Why? It seems like they should have read/write but no execute. What goes wrong?

That might be true if you treat all files as opaque blobs, but services like these do things like resizing images, extracting metadata, and converting to other formats.

Re: Gitlab servers are being exploited in DDoS attacks

#24

Post by ignoramous »

codegeek wrote: post #3

"..Bowling said he discovered a way to abuse how ExifTool handles uploads for DjVu file format used for scanned documents to gain control over the entire underlying GitLab web server" Ah, the good old "File upload vulnerability". File uploads remain one of the hardest problems to solve when it comes to security.

> uploads for DjVu file format used for scanned documents to gain control over the entire underlying GitLab web server

A usecase for WASM's nanoprocesses (capability-based security) perhaps? Of course, until such a time someone exploits the WASM runtime itself.

Re: Gitlab servers are being exploited in DDoS attacks

#25

Post by SahAssar »

surfer7837 wrote: post #15

How can you protect yourself from file upload threats? It's basically the worst possible threat model -- executing complex user input that conforms to a spec that was written 20 years ago by some proprietary company with no security. Executing everything on an isolated container with no permissions? Audit trial etc/good logging? If someone comes up with an RCE you're basically done for, you can only mitigate it but n…

The most straightforward answer is to not process the upload at all, treat it as a binary blob. As for serving it as an image etc. on your site have a strict CSP and turn off mime sniffing (and don't allow SVG uploads as images).

Re: Gitlab servers are being exploited in DDoS attacks

#26

Post by spijdar »

sushsjsuauahab wrote: post #19
mdavidn wrote: post #18

Earlier quoted context omitted.

File formats like PDF contain a script that must be interpreted in order to read the image.

That sounds like a pdf problem ^.^

PDF is an example, but far from the only one. Many file types have executable/scripted portions or simply very complex file formats that have huge attack surfaces. JPEG XL predictors are Turing complete, given an unlimited image size...

Off the top of my head, a lot of old console exploits on the Wii and GameCube revolved feeding malicious save files to games. Same idea, missing bounds checks or whatever when deserializing some field lets you shell the process. Parsing random files from users is just dangerous.

Re: Gitlab servers are being exploited in DDoS attacks

#27

Post by sofixa »

buildbuildbuild wrote: post #2

This happened to all Gitlab instances that I manage around 2 days ago. Good to see publicity, I’m still dealing with not-so-understanding abuse departments at my hosting providers. Sure, my fault for not keeping it up to date. But there is much noise to filter through in the many tools we juggle these days, especially if an organization prefers to self-host.

Honestly GitLab is so stable and foolproof to update you cn have it autoupdate on a schedule like 1-2 weeks after their monthly eelease.

Re: Gitlab servers are being exploited in DDoS attacks

#28

Post by cjbprime »

Eduard wrote: post #6

As the exploit requires uploading a file, is it required for the attacker to first have a user account with file upload permissions?

No. The original submission described the vulnerability as requiring an authenticated user, but it was later discovered (recently) that it works unauthenticated too, and that's what kicked off this mass exploitation. No user account is required.

Re: Gitlab servers are being exploited in DDoS attacks

#29

Post by [deleted] »

buildbuildbuild wrote: post #2

This happened to all Gitlab instances that I manage around 2 days ago. Good to see publicity, I’m still dealing with not-so-understanding abuse departments at my hosting providers. Sure, my fault for not keeping it up to date. But there is much noise to filter through in the many tools we juggle these days, especially if an organization prefers to self-host.

[deleted]

Re: Gitlab servers are being exploited in DDoS attacks

#30

Post by armchairhacker »

surfer7837 wrote: post #15

How can you protect yourself from file upload threats? It's basically the worst possible threat model -- executing complex user input that conforms to a spec that was written 20 years ago by some proprietary company with no security. Executing everything on an isolated container with no permissions? Audit trial etc/good logging? If someone comes up with an RCE you're basically done for, you can only mitigate it but n…

This seems like a great use case for formal methods. e.g. in this case EXIF removers which are formally verified to not crash and successfully remove the identifying data.

These types of programs are relatively simple, and this is a case where a formal proof is much better than reliability.

Is anyone aware of research on this?

Post reply on HN