Back to evidence

Sanitized live incident

Attempted exploitation

Native source identity and targetable endpoints are private.

highopen
Confidence
99%
First seen
Aug 23, 8:33:24 PM PDT
Evidence through
Aug 23, 9:14:25 PM PDT
AI status
Complete
True positive97% confidence

Successful command execution is observed, not merely attempted. Multiple HTTP responses contained non-reflected process-identity output identifying uid 0/root, including in HTTP 400 responses; status therefore does not negate execution. Event-driven process telemetry independently shows root dash shells spawning identity and host-discovery utilities in temporally correlated workloads. The incident is a true positive for command injection leading to root-context command execution and discovery. However, workload/time correlation is not a unique request-to-process edge, and no incident-cited flow evidence was available to establish an outbound connection or request-to-socket causality.

Attack stage
Exploitation with root-context command execution and discovery
Model
gpt-5.6-sol · 16 evidence calls

Observed impact

  • Server-side root/uid 0 process identity was disclosed in three HTTP responses.
  • Root-context shell and discovery processes executed in correlated workloads.
  • Outbound-capable shell processes were spawned, but an actual outbound network connection was not established by available evidence.

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

222 observations · 8 http
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

8 observations · 8 http
Process.correlated network client80%

An outbound-capable client process appeared in the correlated workload and request window

3 observations · 3 process
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

31 observations · 12 process
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

41 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

50 observations · 12 process
Http.server command output85%

Response contains non-reflected process identity output

6 observations · 6 http

Explicit uncertainty

  • The source key is a traffic cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Authorization is not established; broad scanning can be sanctioned testing, although server-generated root output still proves a real execution path.
  • Configured routing and time proximity do not establish a unique HTTP request-to-process parentage edge, particularly across the two observed workloads.
  • No flow-plane event is cited by this incident, so the requested flow-evidence inspection could not establish any outbound connection, destination, command-and-control, or request-to-socket causality.
  • Exact request paths, query strings, headers, bodies, and command text are intentionally absent from bounded evidence summaries, limiting vulnerability-specific attribution.
  • The observed process exits prove those processes ended, not that the workloads are clean or that the incident was contained.
  • No cited evidence proves persistence, host escape, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Temporarily contain the implicated workload instances, preserve their volatile and application evidence, and redeploy from known-good images after assessing service impact.
  2. Identify and fix the API command-injection sink: avoid shell invocation, enforce strict typed input validation and allowlists, and run the service as a non-root identity.
  3. Review application and gateway records for the cited time range and source cluster to determine the vulnerable parameter, affected requests, and whether the activity was authorized testing.
  4. Review secrets, tokens, mounted credentials, and sensitive environment values accessible to the affected root-context workloads; rotate exposed credentials if access cannot be excluded.
  5. Restrict workload egress to required destinations and inspect independent network telemetry for connections near the cited shell executions, because no incident-cited flow evidence was available.
  6. Hunt the implicated workloads and adjacent infrastructure for unauthorized file changes, persistence, additional child processes, or follow-on access; do not infer their presence without evidence.
  7. Add regression tests and detections for command-injection payloads and server-returned command output, including cases where the HTTP response is 4xx or 5xx.