121
Umami is vulnerable - upgrade immediately (jlai.lu)
submitted 11 months ago by to c/selfhosted@lemmy.world
13 comments fedilink hide all child comments
 

All umami instances have been infected with a persisting crypto miner. Umami was affected by the next.js CVE but quietly released a fix, so most of their users missed it

all 13 comments

sorted by: hot top controversial new old
[–] 35 points 11 months ago

I don’t know about “all umami instances being infected” but they were certainly all vulnerable.

  • permalink
  • fedilink
  • source
    •
    [–] 34 points 11 months ago (4 children)

    Link? Did you discover this yourself? There is no actual info here.

  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
  • [–] [S] 12 points 11 months ago (1 child)

    All recently open issues are about this. I was a victim, but I'm not the first and people on reddit have done better investigations than I have. Look for the name of the process at the top

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 32 points 11 months ago*

    Thanks.

    For severe incidents like this, please post the most appropriate link, in this case https://github.com/umami-software/umami/issues/3852

    Admins in self hosted usually don't have that much experience with real, active compromise and may panic, let's help them as much as possible.

    I will add that Umami itself is not compromised, but vulnerable. That is a somewhat misleading title.

    What was the vector? Did you have umami exposed publicly?

  • permalink
  • fedilink
  • source
  • parent
    • [–] 16 points 11 months ago*

    All umami instances have been infected with a persisting crypto miner.

    Source for that claim? Because vulnerable does not mean infected.

    Also, I'm kinda glad my instance has been offline for a while now because of database trouble. That was lucky.

  • permalink
  • fedilink
  • source
    •
    [–] 15 points 11 months ago*

    Look inside

    React2Shell

    Just another day on the job

  • permalink
  • fedilink
  • source
    •
    [–] 8 points 11 months ago (1 child)

    Wow I'm glad I happened to see this here. Thank you for the post. I was just thinking about putting all my services behind a VPN too, I think I'm going to go ahead and put that at the top of the list...

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 3 points 11 months ago (1 child)

    This could explain why my 4C/8T VPS started hitting 100% CPU usage shortly after boot with like next to nothing else running on it.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] -5 points 11 months ago

    I see it's running Ansible. That's an obvious risk.

  • permalink
  • fedilink
  • source
    •