CVE-2026-60004 Elastic Security · Elastic

Detect Gitea Code Injection (CVE-2026-60004) Exploitation in Elastic Security

Detects exploitation of CVE-2026-60004, a code injection vulnerability (CWE-94) in Gitea. Attackers abuse server-side template/hook or repository configuration processing to inject and execute arbitrary code within the Gitea application context. This CVE is listed in the CISA Known Exploited Vulnerabilities catalog (BOD 26-04 scope). Detection focuses on anomalous child processes spawned by the Gitea server binary, suspicious web requests to Gitea endpoints containing injection payloads, and Gitea process activity indicating server-side code execution.

MITRE ATT&CK

Tactic
Initial Access Execution

Elastic Detection Query

Elastic Security (Elastic)
eql 
process where event.type == "start" and
  process.parent.name : ("gitea", "gitea.exe") and
  process.name : ("bash","sh","dash","zsh","python","python3","perl","ruby","php","node","powershell.exe","cmd.exe","curl","wget","nc","ncat","whoami","id") and
  not process.command_line : ("*git-receive-pack*", "*git-upload-pack*", "*hooks/pre-receive*", "*hooks/post-receive*")
high severity medium confidence

EQL rule matching Gitea parent process spawning interpreters or recon/network tools indicative of injected code execution.

Data Sources

Elastic DefendAuditbeat

Required Tables

logs-endpoint.events.process-*

False Positives & Tuning

  • Custom git hooks that legitimately invoke shells
  • Admin scripts executed under the gitea service account
  • Legitimate webhook automation child processes

Other platforms for CVE-2026-60004

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate Gitea spawning a reverse shell interpreter

    Expected signal: Process start event with parent process name 'gitea' and child process 'bash'/'sh' running recon and network commands.

  2. Test 2Gitea process launching Python one-liner

    Expected signal: Process start event: parent 'gitea', child 'python3' with an inline -c command string.

  3. Test 3Gitea spawning network download utility

    Expected signal: Process start event with parent 'gitea' and child 'wget' initiating an outbound HTTP request.

Last updated: 2026-08-26 Research depth: standard
References (4)

Response Playbook

Triage

  1. Identify the affected host and confirm it is running Gitea; determine the installed Gitea version and compare against the fixed release listed in advisory GHSA-rcr6-4jqh-j84m.
  2. Review the flagged process tree: confirm the parent is the gitea binary and inspect the child process command line for interpreter invocation, reverse-shell syntax, or reconnaissance commands.
  3. Correlate the process activity with Gitea web/access logs around the same timestamp to identify the source IP, authenticated user, and repository or endpoint targeted.
  4. Determine whether the child process was a legitimate configured git hook by inspecting the repository's hooks directory and Gitea admin hook configuration.

Containment

  1. Isolate the affected Gitea host from the network to prevent lateral movement or C2 while preserving volatile state for forensics.
  2. Disable or block the offending source account and revoke associated API tokens and SSH keys; force credential rotation for the Gitea service account.
  3. Apply the vendor-fixed Gitea release or, if patching must wait, place the instance behind a WAF/reverse proxy and restrict access to trusted networks.

Evidence Collection

  1. Capture the full process tree, command lines, and environment for the gitea parent and its children (EDR timeline export or auditd/Sysmon logs).
  2. Preserve Gitea application logs, access/web logs, and the repository hooks directories and app.ini configuration for the relevant time window.

Escalation Criteria

  • !Escalate to incident response if the injected process established outbound network connections, downloaded a payload, or spawned a persistent listener.
  • !Escalate if evidence shows access to secrets, repository source theft, credential dumping, or lateral movement to other hosts.

Investigation Guide

Related Techniques

[object Object][object Object]

Forensic Artifacts

  • >Gitea process (gitea/gitea.exe) child process records in EDR/auditd/Sysmon
  • >Gitea access and application logs (gitea.log, access.log) showing the exploit request
  • >Repository hooks directories and app.ini custom configuration modifications

Tuning Guidance

Enumerate all legitimate server-side git hooks and CI/webhook automation configured on your Gitea instances and add their command-line signatures to the exclusion list. If your deployment uses custom hooks that legitimately call shells, scope the detection to unexpected interpreters (python, php, node) and network tools (nc, curl, wget) which are rarely used by benign git hooks. Prioritize alerts where the child process command line contains reverse-shell or download patterns.

Hunting Queries

Baselines all child processes of the Gitea binary across hosts so analysts can spot anomalous interpreter or network-tool executions.

Hunting — KQL
kql 
DeviceProcessEvents | where InitiatingProcessFileName in~ ("gitea","gitea.exe") | summarize count() by FileName, ProcessCommandLine, DeviceName | order by count_ desc
Hunting — SPL
spl 
index=edr | where match(parent_process_name,"(?i)^gitea(\.exe)?$") | stats count by process_name, process, host | sort - count

Atomic Red Team Tests

Test 1 Simulate Gitea spawning a reverse shell interpreter
linux

Renames a shell to 'gitea' and has it spawn a bash child to emulate the process ancestry produced by CVE-2026-60004 code injection. Lab use only.

Command

bash 
cp /bin/sh /tmp/gitea && /tmp/gitea -c '/bin/bash -c "id; whoami; curl -s http://127.0.0.1/atomic-test"'

Cleanup

bash 
rm -f /tmp/gitea

Expected Telemetry

Process start event with parent process name 'gitea' and child process 'bash'/'sh' running recon and network commands.

Expected Detection

kql, spl, elastic_eql, qradar_aql, sumo_logic, chronicle_yaral, and crowdstrike_cql rules alert on gitea parent spawning bash with recon/network commands.

Test 2 Gitea process launching Python one-liner
linux

Emulates injected code executing a Python interpreter as a child of the Gitea binary. Lab use only.

Command

bash 
cp /bin/sh /tmp/gitea && /tmp/gitea -c 'python3 -c "import socket,os; print(socket.gethostname())"'

Cleanup

bash 
rm -f /tmp/gitea

Expected Telemetry

Process start event: parent 'gitea', child 'python3' with an inline -c command string.

Expected Detection

Detection rules flag gitea parent spawning python3 outside the git transport path.

Test 3 Gitea spawning network download utility
linux

Simulates the injected code pulling a second-stage payload via wget/curl as a child of the Gitea server process. Lab use only.

Command

bash 
cp /bin/sh /tmp/gitea && /tmp/gitea -c 'wget -q -O /tmp/atomic_payload http://127.0.0.1/payload'

Cleanup

bash 
rm -f /tmp/gitea /tmp/atomic_payload

Expected Telemetry

Process start event with parent 'gitea' and child 'wget' initiating an outbound HTTP request.

Expected Detection

Rules alert on gitea parent spawning wget/curl network utilities.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter

Same Tactic: Initial Access

Popular Detections