CVE-2023-7028 PoC — Weak Password Recovery Mechanism for Forgotten Password in GitLab

Source

Associated Vulnerability

Readme

# CVE-2023-7028 Exploit - GitLab Password Reset Poisoning Vulnerability

## Overview
This repository contains an exploit for **CVE-2023-7028**, a critical vulnerability in **GitLab** that allows an attacker to abuse the password reset functionality and take over accounts, including administrator accounts.

## Vulnerability Details
- **CVE**: CVE-2023-7028
- **Affected Component**: `/users/password` endpoint in GitLab
- **Impact**: Account Takeover via Password Reset Poisoning
- **Requirements**: Target email address and an attacker-controlled email address

## Exploit Requirements
- Python 3.x
- `requests` library

## Installation
```bash
pip install requests
```

## Usage
```bash
python3 attack.py -u <gitlab_url> -t <target_email> -e <attacker_email>
```
Example:
```bash
python3 attack.py -u http://example.com -t victim@mail.gitlab.thm -e attacker@mail.gitlab.thm
```

## Expected Output
The exploit will send password reset emails to both the victim and the attacker's email addresses. Once executed successfully, check the attacker's mailbox for a password reset link.

## Manual Password Reset
1. Open the attacker's mailbox.
2. Look for an email titled **Reset password instructions**.
3. Click the **Reset password** link.
4. Set a new password and gain access to the target account (default admin username is `root`).

## License
This exploit is intended for educational and authorized testing purposes only.

## Disclaimer
Use this code responsibly. Unauthorized access to systems is illegal.

File Snapshot

 [4.0K]  /data/pocs/f17b1de07962c1d40239486174eb15bdb40e80cd
├── [3.0K]  attack.py
└── [1.5K]  README.md

0 directories, 2 files

Remarks