700+ self-hosted Git instances battered in 0-day attacks

Comments

• scrubbles@poptalk.scrubbles.tech ⁨3⁩ ⁨days⁩ ago

  Good note, and good callout, we should always call out these things.

  But yes if you’re self hosting and you both have a public facing instance and allow open registration, you are a much much braver person than I.

  source

  • jeena@piefed.jeena.net ⁨3⁩ ⁨days⁩ ago

    I’m not allowing random people hosting their git repos on mine but it’s public and they can fork my own stuff on it in theoretically upload some bullshit.

    source

    • Jason2357@lemmy.ca ⁨2⁩ ⁨days⁩ ago

      Any time you have a server willing to process random data uploaded from randos, just expect it to be compromised eventually and prepare for the eventuality by isolating it, backing it up religiously, and setting up good monitoring of some sort. Doesnt matter if its a forge, a wiki, or like nextcloud or whatever. It will happen.

      source

      • -> View More Comments
  • 30p87@feddit.org ⁨3⁩ ⁨days⁩ ago

    git.30p87.de/users/sign_up uhm… oops

    source
• bort@sopuli.xyz ⁨3⁩ ⁨days⁩ ago

  Here are the steps:

  • The attacker creates a standard Git repository.
  • They commit a single symbolic link pointing to a sensitive target.
  • Using the PutContents API, they write data to the symlink. The system follows the link and overwrites the target file outside the repository.
  • By overwriting .git/config (specifically the sshCommand), the attacker can force the system to execute arbitrary commands–

  amazing.

  source

  • addie@feddit.uk ⁨3⁩ ⁨days⁩ ago

    Especially since any version of Git from the last view years has a passionate hatred of symlinks for this reason, which is a bit annoying if you’ve a legit usecase. They’re either very out-of-date, or have done some very foolish customisation…

    source

    • JackbyDev@programming.dev ⁨2⁩ ⁨days⁩ ago

      I think the ZIP standard has something similar and it causes similar problems.

      source

      • -> View More Comments
• 1984@lemmy.today ⁨3⁩ ⁨days⁩ ago

  People have open registration om those things… Thats… Brave…

  source

  • quick_snail@feddit.nl ⁨3⁩ ⁨days⁩ ago

    Well that kinda kills collaboration

    source

    • 1984@lemmy.today ⁨3⁩ ⁨days⁩ ago

      Yeah. If I needed collaboration, I would just whitelist their ips or require everyone involved to use Wireguard vpn, Tailscale or other solutions that allows access without being publically exposed.

      source

      • -> View More Comments
    • greedytacothief@lemmy.dbzer0.com ⁨3⁩ ⁨days⁩ ago

      I do the same thing. Anything I put on there isn’t something that I would share with the Internet anyway. If it was a serious project, sure. It’s just nice to have a personal git you can access over a VPN sometimes.

      source

      • -> View More Comments
    • Jason2357@lemmy.ca ⁨2⁩ ⁨days⁩ ago

      You can git pull a repo to your machine, make your changes and then use git to submit a patch via email. Its not pretty, but it works. Hopefully federation is built soon and you will be able to submit a pull request from your own forge.

      source
  • Lightfire228@pawb.social ⁨2⁩ ⁨days⁩ ago

    I wonder if it’d be feasible to make a fediverse github

    source

    • JackbyDev@programming.dev ⁨2⁩ ⁨days⁩ ago

      Git is already a distributed version control system.

      source

      • -> View More Comments
    • Jason2357@lemmy.ca ⁨2⁩ ⁨days⁩ ago

      Its coming: codeberg.org/…/FederationRoadmap.md

      source
    • dariusj18@lemmy.world ⁨2⁩ ⁨days⁩ ago

      An interesting similar idea is github.com/gitsocial-org/gitsocial

      “Decentralized open-source Git-native social network”

      source
    • eutampieri@feddit.it ⁨2⁩ ⁨days⁩ ago

      There was a discussion on Forgejo and ActivityPub IIRC

      source
  • ITGuyLevi@programming.dev ⁨2⁩ ⁨days⁩ ago

    I keep mine accessible from the internet, its just more useful to me like that. I do have registration disabled though and SSO is handled by Authentik so it could be worse (my personal goal has just been to not be the easiest target, perfect security is a myth in my mind).

    source

    • Jason2357@lemmy.ca ⁨2⁩ ⁨days⁩ ago

      Theres a HUGE difference between hosting it essentially read-only to the world, vs allowing account creation, uploading, and processing unknown files by the server.

      I have thought of blocking access to the commit history pages at the reverse proxy to cut off 99% of the traffic from bots. If anyone wants to look at the history, its just a git clone away.

      source
    • possiblylinux127@lemmy.zip ⁨1⁩ ⁨day⁩ ago

      You could also throw it behind mTLD

      source

      • -> View More Comments
  • irmadlad@lemmy.world ⁨2⁩ ⁨days⁩ ago

    My motto is ‘Users cause complexities and complexities cause problems’.

    source
  • possiblylinux127@lemmy.zip ⁨2⁩ ⁨days⁩ ago

    It is because it is the default

    source
• GreenKnight23@lemmy.world ⁨2⁩ ⁨days⁩ ago

  this is what I’m talking about when it comes to the selfhosted communities.

  if you don’t know how to properly segment and vlan your network, you have no business exposing your shit to the internet.

  source

  • Jason2357@lemmy.ca ⁨2⁩ ⁨days⁩ ago

    While good, network security isnt the issue. Its running a web service with open registration allowing randos to upload content that gets processed by the server.

    Throw this up on a dedicated $5 VPS and you still have a problem. The default should be manual registration by admins.

    source
• Lem453@lemmy.ca ⁨3⁩ ⁨days⁩ ago

  If i remember correctly on my gitea (now forgejo) the default is open registration which really shouldn’t be the case for projects that are targeted towards self hosters.

  My inital install was a long time ago so I don’t remember for sure

  source

  • JadedBlueEyes@programming.dev ⁨3⁩ ⁨days⁩ ago

    Yeah in my project open registration is behind an option called yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse lol

    source

    • JackbyDev@programming.dev ⁨2⁩ ⁨days⁩ ago

      Honestly, this is always more effective than a comment in the config because it can get removed. All it would take is a popular guide having the config with that option on and the comment gone.

      source
  • EncryptKeeper@lemmy.world ⁨2⁩ ⁨days⁩ ago

    Reading between the lines I feel like when you say “Targeted towards self hosters” what you mean is “John Q Hobbyist who doesn’t know any better”

    And in response to that I would contend that Gitea is not actually targeted at those folks, though they obviously use it. Gitea is FOSS but it’s still “targeted” at professionals.

    source
  • AmbiguousProps@lemmy.today ⁨3⁩ ⁨days⁩ ago

    I’m a current gitea user… should I be moving to forgejo?

    source

    • victorz@lemmy.world ⁨3⁩ ⁨days⁩ ago

      Yes, even without this current news.

      forgejo.org/compare-to-gitea/

      source

      • -> View More Comments
    • jjlinux@lemmy.zip ⁨3⁩ ⁨days⁩ ago

      Doesn’t seem like Gitea has that issue, and just keep registrations disabled if possible and if your projects allow, avoid symlinking.

      source
  • Jason2357@lemmy.ca ⁨2⁩ ⁨days⁩ ago

    This absolutely. Anyone who actually wants open registration will be configuring their own SSO or whatever backend. The default should be safe for testing and/or hobbyists.

    source
• AntiBullyRanger@ani.social ⁨3⁩ ⁨days⁩ ago

  1. 🤣😂🤣😂🤣😂🤣
  2. Some1 needs to commiș me to make a clock captça w/mandatory certificate exçŋ verificaș, so ↓ 💩 never occurs.
  3. Xenoglossophobics, bm

  CC

  ç
  ŋ
  ș, in Gregg, used as a substitute for ʃon, as action.
  ↓: this
  💩: shit/poop/troublesome
  bm: block me. Better than DNI

  source

  • AntiBullyRanger@ani.social ⁨3⁩ ⁨days⁩ ago

    lmfao that’s a lot of alts. Seems that my suspicion was correct: the exploiter is a threadiverse user.

    source

    • rumba@lemmy.zip ⁨2⁩ ⁨days⁩ ago

      I think it’s more likely that 29 people feel pretty strongly negative about your writing style.

      source

      • -> View More Comments
    • sexhaver87@sh.itjust.works ⁨2⁩ ⁨days⁩ ago

      What’s more likely, few guys created numerous accounts just to downvote your spam or people just tend to dislike spam?

      source

      • -> View More Comments