700+ self-hosted Git instances battered in 0-day attacks
www.theregister.com
: More than half of internet-exposed instances already compromised

By ‘Git instances’ they mean Gogs instances that allow open registration. I know most of the community moved from Gogs to Gitea, and then to Forgejo, but thought this was still worth noting.

  • 1984@lemmy.todayEnglish
    22·
    5 hours ago

    People have open registration on those things… Thats… Brave…

    I have my own gitea instance in my homelab but of course its not accessable from the internet.

      • 1984@lemmy.todayEnglish
        7·
        2 hours ago

        Yeah. If I needed collaboration, I would just whitelist their ips or require everyone involved to use Wireguard vpn, Tailscale or other solutions that allows access without being publically exposed.

      • greedytacothief@lemmy.dbzer0.comEnglish
        1·
        2 hours ago

        I do the same thing. Anything I put on there isn’t something that I would share with the Internet anyway. If it was a serious project, sure. It’s just nice to have a personal git you can access over a VPN sometimes.

  • bort@sopuli.xyzEnglish
    52·
    7 hours ago

    Here are the steps:

    • The attacker creates a standard Git repository.
    • They commit a single symbolic link pointing to a sensitive target.
    • Using the PutContents API, they write data to the symlink. The system follows the link and overwrites the target file outside the repository.
    • By overwriting .git/config (specifically the sshCommand), the attacker can force the system to execute arbitrary commands–

    amazing.

    • addie@feddit.ukEnglish
      3·
      4 hours ago

      Especially since any version of Git from the last view years has a passionate hatred of symlinks for this reason, which is a bit annoying if you’ve a legit usecase. They’re either very out-of-date, or have done some very foolish customisation…

  • Lem453@lemmy.caEnglish
    12·
    9 hours ago

    If i remember correctly on my gitea (now forgejo) the default is open registration which really shouldn’t be the case for projects that are targeted towards self hosters.

    My inital install was a long time ago so I don’t remember for sure

    • Jade@programming.devEnglish
      1·
      1 hour ago

      Yeah in my project open registration is behind an option called yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse lol

          • klangcola@reddthat.comEnglish
            2·
            5 hours ago

            I just did it not long a ago. Gittea -> Forgejo10 -> Forgejo11 LTS, in Docker. Surprisingly quick, painless and smooth.

            (My only issue was not Forgejo, but MySQL. Because the hardware is ancient and Docker compose pulled down a new version of mysql8 at the same time as pulling forgejo. New version of mysql8 didnt support my CPU architecture. Easy fix was to change the label mysql8oraclelinux7 in Docker compose and pull that image. There is a issue with solutions in the MySQL Docker GitHub repo)

      • youmaynotknow@lemmy.zipEnglish
        1·
        4 hours ago

        Doesn’t seem like Gitea has that issue, and just keep registrations disabled if possible and if your projects allow, avoid symlinking.

  • Scrubbles@poptalk.scrubbles.techEnglish
    104·
    15 hours ago

    Good note, and good callout, we should always call out these things.

    But yes if you’re self hosting and you both have a public facing instance and allow open registration, you are a much much braver person than I.

    • Jeena@piefed.jeena.netEnglish
      19·
      14 hours ago

      I’m not allowing random people hosting their git repos on mine but it’s public and they can fork my own stuff on it in theoretically upload some bullshit.

        • Jeena@piefed.jeena.netEnglish
          3·
          12 hours ago

          Oh, there is still some Lemmy link somewhere? I’m trying to find it but couldn’t, where did you see it?

              • irmadlad@lemmy.worldEnglish
                2·
                55 minutes ago

                I live in South Korea, brew beer

                Way off topic, but I use to be a prolific brewer of beer. In fact the rig that I built can turn 50 gallons of wort in about 3 hours and it’s ready to pitch the yeast in. Brewing beer is a very fascinating process. I also made meads, wines, and have dabbled in sake, tho I wouldn’t say my sake was ready for prime time. LOL And you are a musician. I already like you and I don’t even know you. LOL

                • Jeena@piefed.jeena.netEnglish
                  2·
                  46 minutes ago

                  Haha, yeah, although some of my hobbies slowed down a lot since I got a family. Small children really take up a lot of time.

                  Today for example the 2.5 years old ate a lot of potato’s and schnitzel without really chewing. Then he drank a ton of milk after dinner. While his big sister already went to bed at 21:30 he was still jumping on the bed at 22:00 und suddenly he puked out everything on the bed. So we had to clean RhE bed, the floor, him and us, was everything, shower etc.

                  Now it’s 23:00 and he is still excited about it and is singing in the freshly made bed instead of sleeping.

                  Actually we wanted to watch a episode of some TV series bit now it’s way too late for this.