The developers of the Alpine Linux distribution disclosed information about attempts to hack the collaborative development platform gitlab.alpinelinux.org, on which work was carried out on the package APK manager, build tools, infrastructure components and package build scripts (aports). The attack was carried out by exploiting a vulnerability in the GitLab platform caused by an integer overflow in the regular expression engine of the Ruby language. It was not possible to find evidence or traces of a successful hack, but since it is not possible to completely exclude the successful exploitation of the vulnerability, the container with GitLab was considered potentially compromised and its contents were completely rebuilt from scratch, and the procedure for changing passwords was initiated for users.
Alpine Linux infrastructure administrators did not identify the appearance of third-party files, suspicious running processes, unusual calls to the API, changes to settings and system files, as well as load surges characteristic of bulk extraction data. During the analysis of the integrity of the aports repository, packages and files with releases, as well as their verification with copies from external build servers and developer systems, no hidden changes were identified.
A successful attack cannot be completely ruled out by the lack of information about outgoing network connections, the deletion of some logs during rotation (for example, the cron log) and the lack of proper detail in the web server logs (the successful use of an exploit that does not lead to abnormal termination, is not reflected in the log).
In the event of a successful attack, attackers could gain access to a database with data about all GitLab users (password hashes, email, IP addresses, etc.), environment variables and tokens from continuous integration systems, two-factor authentication codes, hashes of personal access tokens, the contents of private repositories and confidential discussions of problems. The keys for generating digital signatures for releases and packages were not stored on the attacked server.
The first attempts to exploit the vulnerability were recorded on October 20 and 21. The attacker registered an account in GitLab and tried to send modified settings for the continuous integration system. The logs recorded 8 crashes of GitLab workflows, 4 of which were related to the use of the exploit. It is noted that the first phase of the exploit was successful, but the second phase failed.