CVE-2023-7028 PoC — Weak Password Recovery Mechanism for Forgotten Password in GitLab

Source

https://github.com/hackeremmen/gitlab-exploit

Associated Vulnerability

Title:Weak Password Recovery Mechanism for Forgotten Password in GitLab (CVE-2023-7028)
Description:An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.

Description

GitLab CVE-2023-7028

Readme

# gitlab-exploit
GitLab CVE-2023-7028


GitLab CVE-2023-7028
The vulnerability was caused by a bug in how GitLab handled email verification during password reset. An attacker could provide two email addresses during a password reset request, and the reset code would be sent to both addresses. This allowed the attacker to reset the password of any user, even if they didn't know the user's current password.
Affected Versions
All instances of GitLab CE/EE using the following versions were vulnerable:
16.1 to 16.1.5
16.2 to 16.2.8
16.3 to 16.3.6
16.4 to 16.4.4
16.5 to 16.5.5
16.6 to 16.6.3
16.7 to 16.7.1

Exploit:
https://lnkd.in/erWrJjHH
https://lnkd.in/eJaC_EK8
Enable GitLab security alerts that would allow early awareness of patches.
https://lnkd.in/eUqyZT3z

Upgrade GitLab to a patched version.
Enable two-factor authentication (2FA) for all GitLab accounts, especially administrator accounts.
Follow secure coding practices, including proper input validation and email address verification.

File Snapshot


 [4.0K]  /data/pocs/b04a9b284cfd06e1bd0fdf3796f865ec53de9fbc
├── [3.0K]  attack.py
├── [1003]  README.md
└── [ 387]  usage

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!