The developers of the free game engine Luanti, which allows you to create Minecraft-style games, announced an incident as a result of which attackers gained access to the project server serving the directory content.luanti.org, through which the downloading mods, games, add-ons, textures and other resources in the Luanti ecosystem. Personal data, IP addresses and password hashes (bcrypt) of registered users fell into the hands of the attackers. The attackers were also able to make changes to packages distributed through the ContentDB directory.
Access was gained through the exploitation of two vulnerabilities, one of which was in a third-party open source project. Details have not yet been revealed, but changes have been added to the repository of the ContentDB platform in the last few days, blocking generating releases from Git and fixes a vulnerability associated with exposing symlinks to external directories during the “git clone” operation. Also in the repository external access to the API celery-exporter is prohibited through network ports 5125 and 9540 and removed URL present in the code with a stitched identifier for the Grafana monitoring system.
First traces unauthorized activity was recorded on October 22 at 16:00 (MSK) – the attackers gained access to the internal configuration of the platform and were able to connect under the account of one of the administrators, which allows them to make changes to the downloaded content. On October 26 at 3:15 (MSK) the attackers were able to gain full access to the system inside the Docker container and to the project’s DBMS.
On October 26 at 12:00 (MSK) a hack was discovered, the ContentDB service was stopped, and all tokens for access to GitHub (OAuth) and the API were revoked. Comparison of the contents of the catalog with data from the backup copy did not reveal any modification of the packages, but the integrity of the packages uploaded to the catalog from October 22 to October 26 is not guaranteed. Currently, the ContentDB service is disabled and will be returned to service no earlier than in a week.