CVE-2023-7028 Exploit - GitLab Password Reset Poisoning Vulnerability

Overview

This repository contains an exploit for CVE-2023-7028, a critical vulnerability in GitLab that allows an attacker to abuse the password reset functionality and take over accounts, including administrator accounts.

Vulnerability Details

• CVE: CVE-2023-7028
• Affected Component: /users/password endpoint in GitLab
• Impact: Account Takeover via Password Reset Poisoning
• Requirements: Target email address and an attacker-controlled email address

Exploit Requirements

• Python 3.x
• requests library

Installation

pip install requests

Usage

python3 attack.py -u <gitlab_url> -t <target_email> -e <attacker_email>

Example:

python3 attack.py -u http://example.com -t [email protected] -e [email protected]

Expected Output

The exploit will send password reset emails to both the victim and the attacker's email addresses. Once executed successfully, check the attacker's mailbox for a password reset link.

Manual Password Reset

1. Open the attacker's mailbox.
2. Look for an email titled Reset password instructions.
3. Click the Reset password link.
4. Set a new password and gain access to the target account (default admin username is root).

License

This exploit is intended for educational and authorized testing purposes only.

Disclaimer

Use this code responsibly. Unauthorized access to systems is illegal.