CVE-2026-60004 Detection

 

For CVE-2026-60004, there are currently no widely published vendor-provided IOCs such as hashes, IPs, or domains. However, defenders can hunt for the following behavioral indicators of compromise.

High-Confidence IOCs

1. Suspicious API Activity

Look for repeated requests to:

POST /api/v1/repos/<owner>/<repo>/diffpatch

Especially:

• Multiple identical patch submissions
• Requests from newly created accounts
• Activity against repositories with little normal usage

The vulnerability specifically abuses the diffpatch endpoint.

---

2. Unexpected Git Hook Files

Inspect repositories and temporary clone locations for:

hooks/post-index-change

or other unexpected executable files in Git hook directories.

The exploit creates a malicious post-index-change hook that Git executes automatically.

---

3. Command Execution by the Gitea Service Account

Monitor for shell processes spawned by:

gitea

Examples:

/bin/sh
/bin/bash
/usr/bin/env
/usr/bin/curl
/usr/bin/wget

where the parent process originates from Gitea or Git operations.

Successful exploitation results in arbitrary command execution under the Gitea service account.

---

4. Abnormal Git Processes

Look for:

git apply
git update-index
git checkout-index

executing in unusual patterns or causing unexpected file creation within hook directories.

The vulnerability leverages Git's three-way merge fallback during patch processing.

---

5. Repository Objects Containing Command Output

The public research notes that command output can be stored in Git objects and retrieved via Git protocols.

Hunt for:

• Unexpected branches
• Newly created refs
• Commits with unusual binary or text data
• Repositories receiving unexplained object additions

---

Potential System-Level Artifacts

Linux Process Creation

Search audit logs, Sysmon for Linux, or EDR telemetry for:

Parent: gitea
Child: sh, bash, python, perl, ruby, nc, curl, wget

These are strong indicators because Gitea normally should not be launching arbitrary shells.

New Temporary Files

Review:

/tmp
/var/tmp

for files created by the Gitea service account around the time of suspicious diffpatch requests. The attack requires temporary bare repositories and a writable temporary filesystem.

---

Incident Response Checklist

If exposure is suspected:

1. Upgrade immediately to Gitea 1.27.1+.
2. Review Gitea logs for diffpatch endpoint usage.
3. Search for malicious Git hooks, especially post-index-change.
4. Rotate:
   • OAuth secrets
   • API tokens
   • Database credentials
   • SSH keys stored on the server
   • CI/CD credentials
5. Review all commands executed by the Gitea service account since the first suspicious activity.

Because public reporting indicates the exploit can expose configuration data, credentials, repositories, and potentially lead to server compromise, a confirmed exploitation event should be treated as a full Gitea application compromise until proven otherwise.