Luanti's ContentDB was breached between 22 and 26 October: change your password if you reused it

An attacker reached ContentDB's servers, emails, hashed passwords and uploads. The mod site for Luanti, formerly Minetest, is offline for a week or more.

AI-drafted from 2 sources. This story was written with AI from the outside reporting listed under Sources, and checked by automated tools before it went up. The originals have the full detail.

If you have an account on ContentDB, the site where Luanti players and modders download games, mods and texture packs, change that password anywhere else you have used it. The Luanti team says an attacker had access to ContentDB's servers between 22 and 26 October, including email addresses, hashed passwords and uploads. Luanti is the open-source voxel game engine that used to be called Minetest.

What happened

The team says the attacker used two vulnerabilities, one of them in a third-party component that has been reported to its maintainer. Details of that one are being held back until it is fixed. The timeline from the post, in UTC:

• 22 October, from 13:00: the attacker read ContentDB's internal configuration and used it to sign in to a staff account. That configuration could also have changed uploads and sent emails; the team has no evidence that either happened.
• 22 October, 17:35: a patch for one of the holes went out, before anyone knew it had already been used.
• 24 October, from 23:00: the attacker went looking for a way to run code on the server.
• 26 October, from 00:15: they found one, and could run commands inside a Docker container on the server, which most likely meant full access to the database.
• 26 October, 09:00: the team spotted the break-in, took ContentDB offline and revoked every secret, including sessions, API tokens and GitHub sign-in tokens.

What may have been taken

Usernames, email addresses and passwords. The passwords were salted and hashed with bcrypt, not stored as plain text, but the team's advice is blunt: "you should still assume the password you used is no longer safe to use." The attacker may also have IP addresses (not tied to accounts) of anyone who downloaded or viewed a package in the two weeks before 26 October, and the uploaded packages themselves.

On the packages, the team compared every upload against its backups and found no changes. It has not ruled out that tampered files were served to people while the attacker was inside.

What to do

• Change the password anywhere you used the same one, or one like it, as on ContentDB.
• Expect phishing, especially emails that claim to be from Luanti.
• If you downloaded anything from ContentDB between 22 and 26 October, think about downloading it again later, or checking it against the project's own source or the unofficial mirror at contentdb.milcho.org.
• When ContentDB comes back, you will be asked to reset your password and any API tokens.

As of the post, ContentDB was expected to stay offline for a week or more while the team works through security updates. Questions and anything suspicious go to the security contact address given in the post.

A ContentDB staff member, writing in a personal capacity in the comments under GamingOnLinux's report, said the last step to full access went through what looks like a previously unknown flaw in a third-party library that takes untrusted input and runs it as Python code, and that the team will be going back over all of its dependencies. For a volunteer project, it is an unusually clear write-up, published the day after the break-in was found.

Sources

• URGENT: ContentDB security incident (Luanti blog)
• Luanti (formerly Minetest) reveal a major ContentDB security incident (GamingOnLinux)

Image: Zenon Seth / Luanti