The group behind Luanti (previously Minetest), only recently announced a safety incident with their ContentDB system.
What’s ContentDB? ContentDB (brief for “Content material Database”) is the official approach to obtain content material resembling mods, video games, texture packs are extra for Luanti.
Sadly, because the developer mentioned: “an attacker gained unauthorized entry to ContentDB’s servers, together with emails, hashed passwords, and uploads”. The attacker exploited two vulnerabilities, one in all which was a third-party part used that the Luanti builders have reported. As they defined:
What occurred?
An attacker broke into ContentDB by exploiting two vulnerabilities. Considered one of these vulnerabilities was in a third-party part that we’ve reported to the maintainer. We’ll share extra as soon as they’ve been mounted and made public.
From twenty second October 13:00 UTC, the attacker had entry to ContentDB’s inside configuration. We’ve got confirmed that they used this to signal right into a employees account. This configuration additionally allowed modifying uploads and sending emails, however we don’t have any proof that this passed off.
At twenty second October 17:35, coincidentally, we deployed a patch for one of many vulnerabilities. At this level, we didn’t know that it had been exploited already.
From twenty fourth October 23:00, the attacker started to probe the system for distant code execution vulnerabilities.
From twenty sixth October 00:15, we’ve confirmed that the attacker gained full entry to run instructions on our server inside a docker container. Because of this they may have had full entry to the database and will have modified code that ran inside this container.
We found the break-in within the morning and took ContentDB offline at 09:00. We revoked all secrets and techniques.
What could have been accessed?
The attacker had full entry to the secrets and techniques, database, redis, and uploads:
- Account info: usernames, emails, and hashed passwords. Passwords are saved as salted hashes (bcrypt2) and by no means in plain textual content. Sturdy, distinctive passwords are arduous to get better from these hashes, however weak or widespread ones might be guessed.
- IP addresses, not linked to any account, of people that downloaded packages from ContentDB or considered them in-game within the two weeks earlier than twenty sixth of October.
- Uploaded packages and launch recordsdata.
With the key key, they might act on the behalf of any account.
We’ve checked each add in opposition to our backups and have discovered no adjustments. Nonetheless, we haven’t dominated out the likelihood that the attacker triggered ContentDB to serve malicious uploads in the course of the susceptible interval.
Ouch. Hopefully Luanti and the ContentDB can come again stronger from this with enhanced safety. They don’t seem to be the one ones coping with this, particularly with the current PHP issues which we’re nonetheless seeing the fallout from.
Because of AI, we’re more likely to see much more vulnerabilities being exploited going forwards. Because of how straightforward AI brokers make poking and prodding servers, what was once fairly troublesome can now be fairly simply automated.