431
700+ self-hosted Git instances battered in 0-day attacks with no fix imminent (www.theregister.com)
submitted 2 days ago* (last edited 2 days ago) by festus@lemmy.ca to c/selfhosted@lemmy.world
50 comments fedilink hide all child comments

By 'Git instances' they mean Gogs instances that allow open registration. I know most of the community moved from Gogs to Gitea, and then to Forgejo, but thought this was still worth noting.

top 50 comments
sorted by: hot top controversial new old
[-] bort@sopuli.xyz 110 points 2 days ago

Here are the steps:

  • The attacker creates a standard Git repository.
  • They commit a single symbolic link pointing to a sensitive target.
  • Using the PutContents API, they write data to the symlink. The system follows the link and overwrites the target file outside the repository.
  • By overwriting .git/config (specifically the sshCommand), the attacker can force the system to execute arbitrary commands--

amazing.

[-] addie@feddit.uk 27 points 2 days ago

Especially since any version of Git from the last view years has a passionate hatred of symlinks for this reason, which is a bit annoying if you've a legit usecase. They're either very out-of-date, or have done some very foolish customisation...

[-] JackbyDev@programming.dev 2 points 2 days ago

I think the ZIP standard has something similar and it causes similar problems.

[-] PlexSheep@infosec.pub 8 points 1 day ago

It's because of the old notion of "be generous in what you accept and strict in what you send". I think the error is something about adding more parent directories so that part of your zip file will be extracted above the selected directory. Not all implementations of zip support this "feature".

There are also all kinds of stupid ancient features in tar and zip from a time when hard drives were measured in megabytes or less. The latest episode of the open source security podcast talks about it.

[-] Jason2357@lemmy.ca 3 points 1 day ago

We also have COW filesystems now. If you need large datasets in different places, used by different projects, etc, just copy them and use BTRFS or ZFS or whatever. It wont take any space and be safer. Git also has multiple ways of connecting external data artifacts. Git should by default reject symlinks.

[-] PlexSheep@infosec.pub 1 points 1 day ago

This is sadly not easily generalizable, since a lot of people still use legacy operating systems with filesystems like NTFS, which as far as I know is not COW.

[-] The_Decryptor@aussie.zone 2 points 1 day ago

Git itself (Or any other VCS for that matter) really should treat symlinks as special, similar as to how btrfs stores everything as "reflinks" internally. They be stored as special references to other tracked objects (so it'd be impossible to commit a symlink that pointed at anything other than a checked-in file, and ensure they always match), and git can materialise them as needed.

[-] scrubbles@poptalk.scrubbles.tech 134 points 2 days ago

Good note, and good callout, we should always call out these things.

But yes if you're self hosting and you both have a public facing instance and allow open registration, you are a much much braver person than I.

[-] jeena@piefed.jeena.net 29 points 2 days ago

I'm not allowing random people hosting their git repos on mine but it's public and they can fork my own stuff on it in theoretically upload some bullshit.

[-] Jason2357@lemmy.ca 3 points 1 day ago

Any time you have a server willing to process random data uploaded from randos, just expect it to be compromised eventually and prepare for the eventuality by isolating it, backing it up religiously, and setting up good monitoring of some sort. Doesnt matter if its a forge, a wiki, or like nextcloud or whatever. It will happen.

[-] Jason2357@lemmy.ca 2 points 1 day ago

To anyone afraid of the above conclusion, a dedicated $5 VPS with automatic snapshots get you a long way.

[-] WhyJiffie@sh.itjust.works 1 points 5 hours ago

if the server is compromised, all the data it stores is at risk of getting drleted or modified. so I don't think a VPS really solves the problem.

[-] null@piefed.nullspace.lol 12 points 2 days ago

Got curious and lurked your profile. You might want to update your about from Lemmy to PieFed 🙂

[-] jeena@piefed.jeena.net 7 points 2 days ago

Oh, there is still some Lemmy link somewhere? I'm trying to find it but couldn't, where did you see it?

[-] null@piefed.nullspace.lol 11 points 2 days ago

Oh actually it’s on your homepage (jeena.net) in the About section on the left side

[-] jeena@piefed.jeena.net 9 points 2 days ago

Aah, there it was, thanks! Fixed.

[-] irmadlad@lemmy.world 6 points 2 days ago* (last edited 2 days ago)

I live in South Korea, brew beer

Way off topic, but I use to be a prolific brewer of beer. In fact the rig that I built can turn 50 gallons of wort in about 3 hours and it's ready to pitch the yeast in. Brewing beer is a very fascinating process. I also made meads, wines, and have dabbled in sake, tho I wouldn't say my sake was ready for prime time. LOL And you are a musician. I already like you and I don't even know you. LOL

[-] jeena@piefed.jeena.net 8 points 2 days ago

Haha, yeah, although some of my hobbies slowed down a lot since I got a family. Small children really take up a lot of time.

Today for example the 2.5 years old ate a lot of potato's and schnitzel without really chewing. Then he drank a ton of milk after dinner. While his big sister already went to bed at 21:30 he was still jumping on the bed at 22:00 und suddenly he puked out everything on the bed. So we had to clean RhE bed, the floor, him and us, was everything, shower etc.

Now it's 23:00 and he is still excited about it and is singing in the freshly made bed instead of sleeping.

Actually we wanted to watch a episode of some TV series bit now it's way too late for this.

[-] irmadlad@lemmy.world 1 points 2 days ago

Small children really take up a lot of time.

Yeah but that's awesome

[-] Lem453@lemmy.ca 22 points 2 days ago

If i remember correctly on my gitea (now forgejo) the default is open registration which really shouldn't be the case for projects that are targeted towards self hosters.

My inital install was a long time ago so I don't remember for sure

[-] Jason2357@lemmy.ca 2 points 1 day ago

This absolutely. Anyone who actually wants open registration will be configuring their own SSO or whatever backend. The default should be safe for testing and/or hobbyists.

[-] JadedBlueEyes@programming.dev 7 points 2 days ago

Yeah in my project open registration is behind an option called yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse lol

[-] JackbyDev@programming.dev 2 points 2 days ago

Honestly, this is always more effective than a comment in the config because it can get removed. All it would take is a popular guide having the config with that option on and the comment gone.

[-] EncryptKeeper@lemmy.world 5 points 2 days ago

Reading between the lines I feel like when you say “Targeted towards self hosters” what you mean is “John Q Hobbyist who doesn’t know any better”

And in response to that I would contend that Gitea is not actually targeted at those folks, though they obviously use it. Gitea is FOSS but it’s still “targeted” at professionals.

[-] AmbiguousProps@lemmy.today 7 points 2 days ago

I'm a current gitea user.. should I be moving to forgejo?

[-] victorz@lemmy.world 17 points 2 days ago

Yes, even without this current news.

https://forgejo.org/compare-to-gitea/

[-] AmbiguousProps@lemmy.today 4 points 2 days ago

Thanks! I'll add it to the todo list.

[-] klangcola@reddthat.com 3 points 2 days ago

I just did it not long a ago. Gittea -> Forgejo10 -> Forgejo11 LTS, in Docker. Surprisingly quick, painless and smooth.

(My only issue was not Forgejo, but MySQL. Because the hardware is ancient and Docker compose pulled down a new version of mysql8 at the same time as pulling forgejo. New version of mysql8 didnt support my CPU architecture. Easy fix was to change the label mysql8oraclelinux7 in Docker compose and pull that image. There is a issue with solutions in the MySQL Docker GitHub repo)

[-] lambalicious@lemmy.sdf.org 1 points 2 days ago

Doesn't Forgejo support SQLite as a backend?

[-] mko@discuss.tchncs.de 3 points 2 days ago

Yes, although MySQL/MariaDB or PostgreSQL are the more robust options.

[-] lambalicious@lemmy.sdf.org 2 points 2 days ago

If MySQL is more robust than SQLite of all things, something is going seriously wrong.

Then again, it's 2025. I no longer bet on what to expect from reality. Next someone points me to a mail indicating linux kernel will move its bookkeeping to MongoDB.

[-] JackbyDev@programming.dev 2 points 2 days ago

Depends how they define robust. MySQL has a myriad of features SLQite doesn't have and won't ever have. If they mean something like user configuration then SQLite is just out by default.

(Coming from a SQLite fan.)

[-] klangcola@reddthat.com 2 points 2 days ago

To be honest I don't remember why I set up gitea with MySQL instead of sqlite (or MariaDB), its quite a few years ago. And sqlite would probably be fine for my single-user instance

[-] jjlinux@lemmy.zip 1 points 2 days ago

Doesn't seem like Gitea has that issue, and just keep registrations disabled if possible and if your projects allow, avoid symlinking.

[-] AntiBullyRanger@ani.social 2 points 2 days ago* (last edited 2 days ago)
  1. 🤣😂🤣😂🤣😂🤣
  2. Some1 needs to commiș me to make a clock captça w/mandatory certificate X verificaș, so ↓ 💩 never occurs.
  3. Xenoglossophobics, bm

CCç
X
ŋ
ș, in Gregg, used as a substitute for ʃon, as action.
↓: this
💩: shit/poop/troublesome
bm: block me. Better than DNI

[-] AntiBullyRanger@ani.social 3 points 2 days ago

lmfao that's a lot of alts. Seems that my suspicion was correct: the exploiter is a threadiverse user.

[-] rumba@lemmy.zip 10 points 2 days ago

I think it's more likely that 29 people feel pretty strongly negative about your writing style.

[-] AntiBullyRanger@ani.social 1 points 2 days ago

Not the 3-4 minutes instant downvotes🤣 after my reply. It wasn't even 3 minutes unto my response, and I got 12 downvotes across threadiverse instances.

The others forgot to read part 3.

[-] rumba@lemmy.zip 1 points 2 days ago

No, we read part three, it just comes off pretentious enough that we think it still deserves a downvote. It's not a foreign language anxiety; you're posting in English. It's just the next rendition of l33t speak, and no one is really in a hurry for that to catch back on again, those were dar days. I did eventually block the last guy that was hot on thorns, might get to you eventually, but it would be a shame, because outside of the ridiculous way you said it, your point isn't wrong.

[-] AntiBullyRanger@ani.social 1 points 2 days ago* (last edited 2 days ago)

pretentious
you’re […] dar […] isn’t

Stop using contractions then, laughing my ass off.

eventually block the last guy that was hot on thorns

Literally what I asked you to do, mobster.

[-] rumba@lemmy.zip 1 points 2 days ago

If you wouldn't have been grumpy about downvotes, i'd have left it be :)

The community is speaking to you.

[-] AntiBullyRanger@ani.social 1 points 2 days ago

I literally laughing, why would I want to grump about grammarians? I’m literally against mob rule, esp. by pressers.

[-] rumba@lemmy.zip 2 points 2 days ago

I didn't think you could amp-up pretentious at this rate. Do you eventually level off or just keep going further in hopes that people ban you?

[-] AntiBullyRanger@ani.social 2 points 14 hours ago* (last edited 14 hours ago)

Sorry for the wait.

I was soo inspired by this conversation, that I decided to finally do something about it!

I created a community in order to tackle issues threadiverse software hasn't been able to achieve yet, but in hopes people that have the ability to implement them, can do so when possible!

I personally cannot due to financial constraints, but if that ever changes, I would be glad to implement them on piefed as soon as I can!

You can subscribe yourself to any of my DNI list hits if you want! I am also open to criticism if it pertains to DDBF technicalities and my DNI list!

Safe ventures!

[-] rumba@lemmy.zip 2 points 13 hours ago

damn good idea, good on you!

[-] sexhaver87@sh.itjust.works 2 points 2 days ago

Man I sure hope it’s the former!

[-] sexhaver87@sh.itjust.works 4 points 2 days ago

What’s more likely, few guys created numerous accounts just to downvote your spam or people just tend to dislike spam?

[-] AntiBullyRanger@ani.social 1 points 2 days ago

Former.

You know I am an anarchist?

We have a whole host of /c/raid communities, even fash instances.

Also refresh 🧵

[-] sexhaver87@sh.itjust.works 2 points 2 days ago

At least we agree it’s spam

this post was submitted on 10 Dec 2025
431 points (100.0% liked)

Selfhosted

53628 readers
584 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
Loki@lemmy.world
CannaVet@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz