@zereight/mcp-gitlab Unauthenticated Path Traversal Arbitrary File Read (CVE-2026-61560)

let sensitiveTargets = dynamic(["/etc/passwd", "/etc/shadow", ".env", "config.json", ".gitlab", "id_rsa", "credentials"]);
let traversalPatterns = dynamic(["../", "..%2f", "..%5c", "%2e%2e%2f", "....//"]);
union isfuzzy=true
(
  W3CIISLog
  | where csUriStem has "upload_markdown" or csUriQuery has_any (traversalPatterns)
  | where csUriQuery has_any (traversalPatterns) or csUriStem has_any (traversalPatterns)
  | project TimeGenerated, SrcIp = cIP, Uri = strcat(csUriStem, "?", csUriQuery), Method = csMethod, Status = scStatus, Source = "IIS"
),
(
  Syslog
  | where ProcessName has_any ("node", "mcp-gitlab", "gitlab-mcp")
  | where SyslogMessage has "upload_markdown" and SyslogMessage has_any (traversalPatterns)
  | project TimeGenerated, SrcIp = HostIP, Uri = SyslogMessage, Method = "", Status = "", Source = "Syslog"
)
| extend HitSensitive = Uri has_any (sensitiveTargets)
| order by TimeGenerated desc

index=web OR index=proxy OR index=mcp (uri_path="*upload_markdown*" OR uri_query="*upload_markdown*" OR _raw="*upload_markdown*")
| eval combined=uri_path."?".uri_query
| where match(combined, "(?i)(\.\.\/|\.\.%2f|\.\.%5c|%2e%2e%2f|\.\.\.\.\/\/)")
| eval sensitive=if(match(combined, "(?i)(\/etc\/passwd|\/etc\/shadow|\.env|config\.json|id_rsa|credentials|\.gitlab)"), 1, 0)
| stats count min(_time) as firstSeen max(_time) as lastSeen values(combined) as uris by src_ip, sensitive
| where count > 0
| convert ctime(firstSeen) ctime(lastSeen)
| sort - sensitive - count

sequence by host.id with maxspan=5m
  [ network where stringContains(url.original, "upload_markdown") and
      (stringContains(url.original, "../") or stringContains(url.original, "..%2f") or stringContains(url.original, "%2e%2e%2f")) ]
  [ file where event.action == "open" and
      process.name in ("node", "mcp-gitlab", "gitlab-mcp") and
      (file.path : "/etc/passwd" or file.path : "*/.env" or file.path : "*id_rsa*" or file.path : "*credentials*" or file.path : "*/config.json") ]

SELECT sourceip, destinationip, "URL" AS url, QIDNAME(qid) AS event, starttime
FROM events
WHERE ("URL" ILIKE '%upload_markdown%' OR UTF8(payload) ILIKE '%upload_markdown%')
  AND (UTF8(payload) ILIKE '%../%' OR UTF8(payload) ILIKE '%..%2f%' OR UTF8(payload) ILIKE '%2e%2e%2f%')
  AND (UTF8(payload) ILIKE '%/etc/passwd%' OR UTF8(payload) ILIKE '%.env%' OR UTF8(payload) ILIKE '%id_rsa%' OR UTF8(payload) ILIKE '%credentials%')
ORDER BY starttime DESC LAST 24 HOURS

_sourceCategory=*mcp* OR _sourceCategory=*proxy* OR _sourceCategory=*web*
| where _raw matches /(?i)upload_markdown/
| where _raw matches /(?i)(\.\.\/|\.\.%2f|%2e%2e%2f|\.\.%5c)/
| if (_raw matches /(?i)(\/etc\/passwd|\.env|id_rsa|credentials|config\.json|\.gitlab)/, 1, 0) as sensitive
| parse regex "(?<src_ip>\d+\.\d+\.\d+\.\d+)" nodrop
| count by src_ip, sensitive
| sort by sensitive, _count desc

rule mcp_gitlab_upload_markdown_traversal_cve_2026_61560 {
  meta:
    author = "argus"
    description = "Path traversal via upload_markdown in @zereight/mcp-gitlab (CVE-2026-61560)"
    severity = "CRITICAL"
    cve = "CVE-2026-61560"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex($e.network.http.parsed_user_agent, ".*") or true
    re.regex($e.target.url, `(?i)upload_markdown`)
    re.regex($e.target.url, `(?i)(\.\./|\.\.%2f|%2e%2e%2f|\.\.%5c)`)
    $ip = $e.principal.ip
  match:
    $ip over 5m
  condition:
    $e
}

#event_simpleName=/^(NetworkConnect|ProcessRollup2|ScriptControl)$/
| (CommandLine=/upload_markdown/i OR HttpUrl=/upload_markdown/i)
| (CommandLine=/(\.\.\/|\.\.%2f|%2e%2e%2f)/i OR HttpUrl=/(\.\.\/|\.\.%2f|%2e%2e%2f)/i)
| FileName=/node|mcp-gitlab|gitlab-mcp/i
| groupBy([aid, ComputerName], function=collect([CommandLine, HttpUrl, timestamp]))