gitlab-exploit

gitlab-exploit GitLab CVE-2023-7028 GitLab CVE-2023-7028 该漏洞是由于GitLab在密码重置过程中处理电子邮件验证的方式存在缺陷所致。攻击者可在密码重置请求中提供两个电子邮件地址，重置码将发送到这两个地址。这使得攻击者能够重置任何用户的密码，即使不知道用户的当前密码。 受影响版本 所有使用以下版本的 GitLab CE/EE 实例均受影响： 16.1 到 16.1.5 16.2 到 16.2.8 16.3 到 16.3.6 16.4 到 16.4.4 16.5 到 16.5.5 16.6 到 16.6.3 16.7 到 16.7.1...

CVE-2023-7028-GitLab

GitLab-CVE-2023-7028 示例 python3 attack.py -u http://TargetIP:8000 -t [email protected] -e [email protected]...

CVE-2023-7028-Docker

CVE-2023-7028 con Docker 🎯 ¿Quieres practicar con la nueva CVE de Gitlab? Sigue las instrucciones Construye el laboratorio 1. Instala Docker : https://docs.docker.com/get-docker/ 2. Clona el proyecto : git clone https://github.com/Trackflaw/CVE-2023-7028-Docker.git. 3. Ve al proyecto : cd...

Exploiting-GitLab-CVE-2023-7028

针对CVE-2023-7028的渗透测试...

CVE-2023-7028

GitLab CVE-2023-7028 POC root@kitploit: [email protected]&[email protected] 科研机构base成都-招聘网络安全研究人员（私）...

CVE-2023-7028

CVE-2023-7028lab 针对CVE-2023-7028账户接管漏洞的实现与利用，该漏洞与第11周的GO-TO CVE每周文章相关。 此仓库包含一个Docker设置和一个Python脚本，用于测试GitLab中的CVE-2023-7028漏洞。提供的脚本可自动化利用过程。 前提条件 系统已安装Docker和Docker Compose。 具备Docker和Python的基础知识。 设置说明 1. 安装Docker 如果系统尚未安装Docker，请使用以下命令进行安装： root@kitploit: sudo apt-get update sudo apt-get install...

CVE-2023-7028

CVE-2023-7028: CVE-2023-7028 漏洞利用工具 描述： 该 Python 脚本自动化利用 GitLab 实例上的假设性安全漏洞（CVE-2023-7028）。它有助于对指定的目标电子邮件地址进行密码重置攻击，从而展示潜在的安全风险。该工具支持用于 GitLab URL、目标电子邮件和可选参数的命令行选项，并增强了从文件处理多个 URL 和电子邮件的能力。注意：此脚本仅供教育目的使用，不应用于未经授权或恶意的活动。 功能： 自动在 GitLab 上利用 CVE-2023-7028 漏洞 通过检索 CSRF 令牌进行密码重置攻击 用法： root@kitploit:...

Linux Distros Unpatched Vulnerability : CVE-2023-7028

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5,...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab

CVE-2023-7028 | Account-Take-Over Gitlab Disclamer This c...

📄 GitLab 16.7.2 Account Takeover

GitLab version 16.7.2 proof of concept account takeover via password reset exploit. Exploit Title: GitLab 16.7.2 - Account Takeover via Password Reset without user interactions Date: 2025-04-16 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H:...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab

CVE-2023-7028 Exploit - GitLab Password Reset Poisoning Vulner...

CISA Warns of Active Exploitation of Severe GitLab Password Reset Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency CISA has added a critical flaw impacting GitLab to its Known Exploited Vulnerabilities KEV catalog, owing to active exploitation in the wild. Tracked as CVE-2023-7028 CVSS score: 10.0, the maximum severity vulnerability could facilitate...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-7028 GitLab Community and Enterprise Editions Improper Access Control Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cybe...

GitLab CE/EE < 16.7.2 - Password Reset Vulnerability

Exploit Title: GitLab CE/EE 16.7.2 - Password Reset Exploit Author: Sebastian Kriesten 0xB455 Twitter: https://twitter.com/0xB455 Vendor Homepage: gitlab.com Vulnerability disclosure: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/ Version: 16.7.2,...

GitLab CE/EE Password Reset

Exploit Title: GitLab CE/EE 16.7.2 - Password Reset Exploit Author: Sebastian Kriesten 0xB455 Twitter: https://twitter.com/0xB455 Date: 2024-01-12 Vendor Homepage: gitlab.com Vulnerability disclosure: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/...

GitLab CE/EE < 16.7.2 - Password Reset

Exploit Title: GitLab CE/EE 16.7.2 - Password Reset Exploit Author: Sebastian Kriesten 0xB455 Twitter: https://twitter.com/0xB455 Date: 2024-01-12 Vendor Homepage: gitlab.com Vulnerability disclosure: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/...

GitLab warns zero-click vulnerability could lead to account takeovers

GitLab has issued a warning about a critical vulnerability in GitLab Community Edition CE and Enterprise Edition EE. GitLab is an online DevOps platform that allows developers to collaborate on creating software. Organizations have a choice to install GitLab on their own servers or under GitLab’s...

Exploit for Weak Password Recovery Mechanism for Forgotten Password in Gitlab

CVE-2023-7028 | Account-Take-Over Gitlab Disclamer This co...

CVE-2023-7028 Weak Password Recovery Mechanism for Forgotten Password in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to a...

CVE-2023-7028 Weak Password Recovery Mechanism for Forgotten Password in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to a...