detection.wiki

Detection rules › Panther

Panther rules: gitlab

RuleSeverity
CVE-2023-7028 - GitLab Audit Password Reset Multiple Emailshigh
CVE-2023-7028 - GitLab Production Password Reset Multiple Emailshigh

CVE-2023-7028 - GitLab Audit Password Reset Multiple Emails

#
Severity
high
Log types
GitLab.Audit
Tags
GitLab, CVE-2023-7028, No Pack
Reference
about.gitlab.com
Source
github.com/panther-labs/panther-analysis

Attackers are exploiting a Critical (CVSS 10.0) GitLab vulnerability in which user account password reset emails could be delivered to an unverified email address.

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Persistence

Detection logic

import json


def rule(event):
    custom_message = event.deep_get("detail", "custom_message", default="")
    emails_raw = event.deep_get("detail", "target_details", default="")

    if custom_message != "Ask for password reset":
        return False

    try:
        emails = json.loads(emails_raw)
    except json.decoder.JSONDecodeError:
        return False

    if len(emails) > 1:
        return True
    return False


def title(event):
    emails = event.deep_get("detail", "target_details", default="")
    return f"[GitLab] Multiple password reset emails requested for {emails}"

Rule specification

AnalysisType: rule
Filename: gitlab_audit_password_reset_multiple_emails.py
RuleID: "GitLab.Audit.Password.Reset.Multiple.Emails"
DisplayName: "CVE-2023-7028 - GitLab Audit Password Reset Multiple Emails"
Enabled: True
LogTypes:
  - GitLab.Audit
Tags:
  - GitLab
  - CVE-2023-7028
  - No Pack
Reports:
  MITRE ATT&CK:
    - TA0001:T1195
    - TA0001:T1190
    - TA0003:T1098
Severity: High
Description: Attackers are exploiting a Critical (CVSS 10.0) GitLab vulnerability in which user account password reset emails could be delivered to an unverified email address.
Reference: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/

Stages and Predicates

Fires on GitLab.Audit events when the condition below holds.

Condition

  • detail.custom_message is Ask for password reset

This rule also runs imperative logic the parser cannot express as a filter. The conditions above are the structured part it could extract.

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
detail.custom_messageeq
  • Ask for password reset
field:"detail.custom_message" kind:eq value:"Ask for password reset"

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

FieldSource
target_detailsdetail.target_details

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event 
{
  "detail": {
    "custom_message": "Ask for password reset",
    "target_details": "[\"example@test.com\", \"example2@test.com\"]"
  }
}

CVE-2023-7028 - GitLab Production Password Reset Multiple Emails

#
Severity
high
Log types
GitLab.Production
Tags
GitLab, CVE-2023-7028, No Pack
Reference
about.gitlab.com
Source
github.com/panther-labs/panther-analysis

Attackers are exploiting a Critical (CVSS 10.0) GitLab vulnerability in which user account password reset emails could be delivered to an unverified email address.

MITRE ATT&CK coverage

TacticTechniques
Initial Access
Persistence

Detection logic

from panther_base_helpers import deep_get
from panther_core.immutable import ImmutableList


def rule(event):
    path = event.get("path", "")

    if path != "/users/password":
        return False

    params = event.get("params", [])
    for param in params:
        if param.get("key") == "user":
            email = deep_get(param, "value", "email", default=[])
            if isinstance(email, ImmutableList) and len(email) > 1:
                return True
    return False


def title(event):
    emails = event.deep_get("detail", "target_details", default="")
    return f"Someone tried to reset your password with multiple emails :{emails}"

Rule specification

AnalysisType: rule
Filename: gitlab_production_password_reset_multiple_emails.py
RuleID: "GitLab.Production.Password.Reset.Multiple.Emails"
DisplayName: "CVE-2023-7028 - GitLab Production Password Reset Multiple Emails"
Enabled: True
LogTypes:
  - GitLab.Production
Tags:
  - GitLab
  - CVE-2023-7028
  - No Pack
Reports:
  MITRE ATT&CK:
    - TA0001:T1195
    - TA0001:T1190
    - TA0003:T1098
Severity: High
Description: Attackers are exploiting a Critical (CVSS 10.0) GitLab vulnerability in which user account password reset emails could be delivered to an unverified email address.
Reference: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/

Stages and Predicates

Fires on GitLab.Production events when all of the conditions below hold.

Condition

  • path is /users/password
  • any element of params matches all of:
    • params.key is user
    • params.value.email has length greater than 1

This rule also runs imperative logic the parser cannot express as a filter. The conditions above are the structured part it could extract.

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
patheq
  • /users/password
field:"path" kind:eq value:"/users/password"

Output fields

Fields the rule emits when it matches, drawn from the rule's alert_context.

FieldSource
target_detailsdetail.target_details

Worked example

A sample event from the rule's unit tests that triggers a match.

Sample Test Event 
{
  "params": [
    {
      "key": "authenticity_token",
      "value": "[FILTERED]"
    },
    {
      "key": "user",
      "value": {
        "email": [
          "peter@example.com",
          "bob@example.com"
        ]
      }
    }
  ],
  "path": "/users/password"
}