Skip to content

Instantly share code, notes, and snippets.

@mqu

mqu/gist:be4e4fcd858d1bd7c6b15f87d6d6921a

Created September 12, 2026 08:46
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save mqu/be4e4fcd858d1bd7c6b15f87d6d6921a to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save mqu/be4e4fcd858d1bd7c6b15f87d6d6921a to your computer and use it in GitHub Desktop.
Download ZIP
gitlab/CVE-2026-85706/IOCS
Raw
gistfile1.txt
root@gitlab:/var/log/gitlab/gitlab-rails# cat api_json.log | grep "repository/commits" | grep -E '"status":4[0-9]{2}|"status":5[0-9]{2}' | jq 'select(.path | test("repository/commits")) | select(.method=="POST")' | jq .remote_ip | sort | uniq -c | sort -rn
30 "138.199.15.172, 138.199.15.172"
30 "138.199.15.172"
6 "159.26.96.85, 159.26.96.85"
3 "194.163.163.146"
2 "68.178.160.183"
1 "5.196.56.134, 5.196.56.134"
1 "5.135.209.134, 5.135.209.134"
@mqu

mqu commented Sep 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

we can see for example :

  "params": [
   ...
    {
      "key": "file.path",
      "value": "/proc/self/environ"
    },
  ],
...
  {
    "key": "file.path",
    "value": "/var/opt/gitlab/.ssh/id_rsa"
  },
...
  {
    "key": "file.path",
    "value": "/opt/gitlab/embedded/service/gitlab-rails/config/initializers/secret_token.rb"
  },
...
  {
    "key": "file.path",
    "value": "/var/opt/gitlab/gitlab-rails/etc/secrets.yml"
  },

@mqu

mqu commented Sep 12, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

résumé : tentatives d'accès a l'API qui ont échoué (status != 200) ; journée courante (après upgrade).

root@gitlab:/var/log/gitlab/gitlab-rails# cat  api_json.log | grep "repository/commits" | grep -E '"status":4[0-9]{2}|"status":5[0-9]{2}' | jq .params | grep value | grep '"/' | sort | uniq -c | sort -rn
     60     "value": "/nonexistent-cve-2026-85706-probe"
      8     "value": "/var/opt/gitlab/postgresql"
      6     "value": "/tmp/this-file-does-not-exist-627748"
      4     "value": "/var/opt/gitlab/.ssh/id_rsa"
      4     "value": "/var/opt/gitlab/gitlab-rails/etc/secrets.yml"
      4     "value": "/root/.ssh/id_rsa"
      4     "value": "/proc/self/environ"
      4     "value": "/opt/gitlab/embedded/service/gitlab-rails/config/secrets.yml"
      4     "value": "/opt/gitlab/embedded/service/gitlab-rails/config/initializers/secret_token.rb"
      4     "value": "/opt/gitlab/embedded/service/gitlab-rails/config/gitlab.yml"
      4     "value": "/opt/gitlab/embedded/service/gitlab-rails/config/database.yml"
      4     "value": "/etc/passwd"
      4     "value": "/etc/os-release"
      4     "value": "/etc/hostname"
      4     "value": "/etc/gitlab/gitlab-secrets.json"
      4     "value": "/etc/gitlab/gitlab.rb"
      1     "value": "/opt/gitlab/embedded/service/gitlab-rails/public/uploads/tmp/commits/gitlab-workhorse-upload3801197670"
      1     "value": "/opt/gitlab/embedded/service/gitlab-rails/public/uploads/tmp/commits/gitlab-workhorse-upload2056344451

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment