thanhlam-attt/cve-2023-7028Exploit for GitLab account takeover via CVE-2023-7028, demonstrating password reset bypass by injecting attacker email to receive reset token.
GitLab is a widely adopted web-based repository manager that provides a comprehensive platform for managing source code, integration, maintenance, and collaboration in software development projects.CVE-2023-7028 is a vulnerability that allows an attacker to take over user accounts (Account TakeOver) through the reset password form.versions of GitLab:
reset password form, specifically the API endpoint POST /users/password of GitLab. The attacker exploits a flaw in the email address field by bypassing format validation checks, allowing the attacker to inject their own email. As a result, GitLab sends the to the attacker's email.reset tokenBased on the code snippet provided by GitLab, we observe the following:
The Reset Password request handling logic is located in the file spec/controllers/passwords_controller_spec.rb, which allows multiple emails to be entered from the input but lacks any email verification mechanism to confirm that the email belongs to the user.
The server only requires an authenticity_token (a hidden token used to prevent CSRF) from the attacker in the form submission to send the password reset request.
→ We can inject our own email to receive the reset token for resetting the victim's password, thereby taking over the user account.
Capturing the password reset request yields the following:
authenticity_token used to prevent CSRF, and the email of the user whose password is being reset is placed in the user[email] variable.Add the attacker's email using the following payload &user[email][]=victim_email&user[email][]=attacker_email and send the request:
→ Checking the attacker's email reveals that the password reset token has been sent and can be accessed to change the password.
