PT-2024-1045 · Gitlab · Gitlab

Jakaba03 · Published 2024-01-11 · Updated 2026-05-24 · CVE-2023-7028

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 16.1 through 16.7.1

Description The issue allows an attacker to specify a secondary email during a password reset request, enabling account takeover via password reset without user interaction. This vulnerability affects GitLab Community Edition (CE) and Enterprise Edition (EE) and has a maximum severity score. Over 5,300 internet-exposed GitLab instances are vulnerable to this flaw. The vulnerability can be exploited by sending a password reset email to an unverified email address, allowing an attacker to take over an account. Two-factor authentication can prevent account takeover but not password reset.

Recommendations For GitLab versions 16.1 through 16.7.1, update to the latest patched version, such as 16.7.2, 16.6.4, or 16.5.6, to prevent account takeover via password reset. Enable two-factor authentication to add an extra layer of security and prevent account takeover, even if the password is reset. As a temporary workaround, consider restricting access to the password reset feature until a patch is applied.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-640

CWE-284

Related Identifiers

BDU:2024-00259

BIT-GITLAB-2023-7028

CVE-2023-7028

Affected Products

Gitlab

References · 279

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/gitlab_password_reset_account_takeover.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/7xxx/CVE-2023-7028.json · Exploit
• 🔥 https://github.com/Vozec/CVE-2023-7028 · Exploit
• 🔥 https://github.com/RandomRobbieBF/CVE-2023-7028 · Exploit
• 🔥 https://github.com/duy-31/CVE-2023-7028 · Exploit
• 🔥 https://github.com/Esonhugh/gitlab_honeypot · Exploit
• 🔥 https://github.com/sariamubeen/CVE-2023-7028 · Exploit
• 🔥 https://hackerone.com/reports/2293343 · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/436084 · Exploit
• 🔥 https://exploit-db.com/exploits/51889 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028 · Exploit
• 🔥❌ https://github.com/V1lu0/CVE-2023-7028 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2023-7028 · Security Note
• https://ubuntu.com/security/CVE-2023-7028 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2023-7028 · Vendor Advisory