关联漏洞
标题：
GitLab 安全漏洞
(CVE-2023-7028)
描述：GitLab是美国GitLab公司的一个开源的端到端软件开发平台，具有内置的版本控制、问题跟踪、代码审查、CI/CD（持续集成和持续交付）等功能。 GitLab 存在安全漏洞，该漏洞源于用户帐户密码重置电子邮件可能会发送到未经验证的电子邮件地址。
描述
GitLab CVE-2023-7028
介绍
# gitlab-exploit
GitLab CVE-2023-7028
GitLab CVE-2023-7028
The vulnerability was caused by a bug in how GitLab handled email verification during password reset. An attacker could provide two email addresses during a password reset request, and the reset code would be sent to both addresses. This allowed the attacker to reset the password of any user, even if they didn't know the user's current password.
Affected Versions
All instances of GitLab CE/EE using the following versions were vulnerable:
16.1 to 16.1.5
16.2 to 16.2.8
16.3 to 16.3.6
16.4 to 16.4.4
16.5 to 16.5.5
16.6 to 16.6.3
16.7 to 16.7.1
Exploit:
https://lnkd.in/erWrJjHH
https://lnkd.in/eJaC_EK8
Enable GitLab security alerts that would allow early awareness of patches.
https://lnkd.in/eUqyZT3z
Upgrade GitLab to a patched version.
Enable two-factor authentication (2FA) for all GitLab accounts, especially administrator accounts.
Follow secure coding practices, including proper input validation and email address verification.
文件快照
[4.0K] /data/pocs/b04a9b284cfd06e1bd0fdf3796f865ec53de9fbc
├── [3.0K] attack.py
├── [1003] README.md
└── [ 387] usage
0 directories, 3 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。