A creapy exploit...” the Webmin source code had been maliciously modified to add a non-obvious vulnerability’ question: how is or was the proces for commiting the malicious pull request in July 2018 orgazized?
back
1 comments
Seems like there was no commit. Instead of commiting code, 'they' hacked the build server somehow, and modified files on a synced directory Webmin used for building its packages.
doesn't git hold a checksum for all files changed in a change-set ?
As an optimization git doesn't check files with an "old" date.
Running git status in an 1 GB checkout directory will return instantly. Do you really believe it has hashed all those files?
That doesn't stop you from changing something in your working copy.
The hack here is that the working copy used to build from wasn't a clean clone on each build, so just fetching changes from the (un-pwned) github repository would apply those changes and not affect the modified file on the build server.