CVE-2023-7028
GitLab Community and Enterprise Editions Improper Access Control Vulnerability
Description
CVE-2023-7028 is a critical account takeover vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE) that allows an unauthenticated attacker to reset any user's password by manipulating the password reset email delivery mechanism to send reset tokens to an attacker-controlled email address. With a perfect CVSS v3.1 base score of 10.0, this vulnerability requires no authentication, no user interaction, and can be exploited remotely with low complexity. CISA has added CVE-2023-7028 to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of May 22, 2024, and its EPSS score of 93.38% at the 99.8th percentile confirms that this is one of the most aggressively exploited vulnerabilities in the current threat landscape.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | >= 16.1.0, < 16.1.6; >= 16.2.0, < 16.2.9; >= 16.3.0, < 16.3.7; >= 16.4.0, < 16.4.5; >= 16.5.0, < 16.5.6; >= 16.6.0, < 16.6.4; >= 16.7.0, < 16.7.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/436084(Exploit, Issue Tracking, Vendor Advisory)
- https://hackerone.com/reports/2293343(Permissions Required)
- https://www.vicarius.io/vsociety/posts/critical-gitlab-account-takeover-vulnerability-cve-2023-7028(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-7028(US Government Resource)
Weakness Type
Password Reset Token Delivery to Unverified Email
CVE-2023-7028 exploits a flaw in GitLab's password reset functionality where the application delivers password reset emails to unverified email addresses. When a user initiates a password reset, GitLab's implementation allows an attacker to inject or substitute an additional email address into the reset request, causing the password reset link containing a valid token to be sent to the attacker's email instead of or in addition to the legitimate account holder's email. This weakness is closely related to CWE-640 (Weak Password Recovery Mechanism for Forgotten Password), which describes flaws in password recovery implementations that can be abused to gain unauthorized access, and CWE-284 (Improper Access Control), where the application fails to properly restrict who can receive security-sensitive password reset tokens. Learn more about CWE-640
Impact Analysis
The impact of CVE-2023-7028 is catastrophic, earning the maximum possible CVSS score of 10.0 with a changed scope. Confidentiality is rated high with changed scope (S:C) because an attacker who takes over a GitLab account gains access to all repositories, CI/CD pipelines, secrets, deployment keys, API tokens, and private project data associated with that account. If the compromised account has administrative privileges, the attacker gains access to the entire GitLab instance, including all user data, project configurations, and organizational secrets.
Integrity faces maximum impact because the attacker can modify source code in any repository accessible to the compromised account, inject malicious code into CI/CD pipelines, alter release artifacts, modify merge request approvals, and tamper with audit logs. For organizations using GitLab for software delivery, this enables supply chain attacks where malicious code is injected into production deployments through legitimate CI/CD processes.
Availability is not directly rated in the CVSS vector (A:N), but the practical impact includes the ability to delete repositories, revoke access for legitimate users, disable CI/CD pipelines, and disrupt development workflows. The attack requires no authentication (PR:N), no user interaction (UI:N), and can be executed remotely (AV:N) with low complexity (AC:L). The EPSS score of 93.38% at the 99.8th percentile is nearly the maximum possible, indicating that exploitation is occurring at massive scale. CISA classifies the ransomware association as "Unknown," but the ability to compromise source code repositories and CI/CD pipelines represents a severe supply chain risk.
Exploit Maturity
CVE-2023-7028 has reached maximum exploit maturity with widespread active exploitation confirmed by multiple sources. The vulnerability was disclosed through the GitLab issue tracker, and detailed exploitation techniques have been published. A Vicarius analysis provides a comprehensive breakdown of the exploit mechanism, and the vulnerability was initially reported through HackerOne.
The EPSS score of 93.38% at the 99.8th percentile places this among the top 0.2% of all vulnerabilities for exploitation probability, reflecting massive real-world attack activity. The exploit is trivially simple, requiring only manipulation of the password reset HTTP request to include an attacker-controlled email parameter. No sophisticated tooling or deep technical knowledge is required, which dramatically lowers the barrier to exploitation. CISA's inclusion in the KEV catalog confirms active exploitation by threat actors. The ransomware association is classified as "Unknown," but the ability to compromise GitLab instances provides attackers with access to source code, deployment credentials, and CI/CD pipelines that can be leveraged for supply chain attacks, data exfiltration, and persistent access to downstream systems.
Remediation
-
Update GitLab immediately to a patched version. Affected versions span GitLab CE/EE 16.1.0 through 16.7.1. Install one of the following fixed versions: 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, or 16.7.2. The patches are available through the standard GitLab update channels and should be applied as an emergency change.
-
Enable two-factor authentication (2FA) for all GitLab accounts, especially administrator and service accounts. Even if an attacker resets a password using this vulnerability, 2FA provides an additional authentication barrier that prevents account access without the second factor.
-
Audit all password reset events in GitLab logs for signs of exploitation. Review the application logs for password reset requests that include multiple email addresses, resets for administrative accounts, and any account access from unusual IP addresses or locations following a password reset.
-
Rotate all credentials and tokens for accounts that may have been compromised. This includes personal access tokens, deploy keys, CI/CD variables containing secrets, SSH keys, and any API tokens associated with GitLab accounts. Review recent commits and pipeline executions for unauthorized changes.
-
Implement network-level access controls to restrict who can reach the GitLab password reset endpoint. Consider placing GitLab behind a VPN or zero-trust access gateway, and implement rate limiting on authentication endpoints to slow down mass exploitation attempts.
Technical Details
CVE-2023-7028 is an account takeover vulnerability in GitLab CE/EE affecting all versions from 16.1.0 through 16.7.1. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, resulting in the maximum base score of 10.0 (Critical).
The vulnerability resides in GitLab's password reset implementation. When a user requests a password reset, the application generates a reset token and sends it to the email address associated with the account. The flaw allows an attacker to manipulate the password reset HTTP request by including an additional email parameter that causes GitLab to send the reset token to both the legitimate account email and the attacker-controlled email address. The attacker then uses the received token to set a new password and gain full access to the target account.
The technical root cause is improper validation of the email parameter in the password reset endpoint. GitLab's implementation accepts array-formatted email parameters (e.g., user[email][][email protected]&user[email][][email protected]), and the password reset logic processes all provided email addresses without verifying that they belong to the target account. This allows the reset token to be delivered to an email address that the attacker controls.
The Attack Vector (AV:N) confirms fully remote exploitation. Attack Complexity (AC:L) is low because the exploit requires only an HTTP request modification. Privileges Required (PR:N) is none, as no GitLab account is needed. User Interaction (UI:N) is none, making this a fully automated attack. The Scope (S:C) is changed because compromising a GitLab account provides access to resources beyond GitLab itself, including deployment targets, connected services, and downstream systems. Confidentiality (C:H) and Integrity (I:H) are both rated high due to full account access, while Availability (A:N) is not directly impacted by the vulnerability itself. Affected versions include GitLab 16.1.0-16.1.5, 16.2.0-16.2.8, 16.3.0-16.3.6, 16.4.0-16.4.4, 16.5.0-16.5.5, 16.6.0-16.6.3, and 16.7.0-16.7.1.
Frequently Asked Questions
What is CVE-2023-7028?
CVE-2023-7028 is a critical account takeover vulnerability in GitLab CE/EE that allows an unauthenticated attacker to hijack any user account by manipulating the password reset mechanism to send reset tokens to an attacker-controlled email address. It carries the maximum CVSS score of 10.0.
How does the exploit work?
The attacker sends a password reset request to the GitLab instance with a manipulated email parameter that includes both the victim's email and their own. GitLab sends the reset token to both addresses, allowing the attacker to use the token to change the victim's password.
Can two-factor authentication prevent exploitation?
Two-factor authentication does not prevent the password reset itself, but it provides a critical additional barrier. Even if an attacker resets the password, they cannot log in without the second authentication factor, making 2FA the most effective mitigation short of patching.
Which GitLab versions are affected?
All GitLab CE/EE versions from 16.1.0 through 16.7.1 are vulnerable. Organizations should update to versions 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, or 16.7.2 to remediate the vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.