Detection rules › Panther
CVE-2023-7028 - GitLab Audit Password Reset Multiple Emails
Attackers are exploiting a Critical (CVSS 10.0) GitLab vulnerability in which user account password reset emails could be delivered to an unverified email address.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1190 Exploit Public-Facing Application, T1195 Supply Chain Compromise |
| Persistence | T1098 Account Manipulation |
Rule body yaml
AnalysisType: rule
Filename: gitlab_audit_password_reset_multiple_emails.py
RuleID: "GitLab.Audit.Password.Reset.Multiple.Emails"
DisplayName: "CVE-2023-7028 - GitLab Audit Password Reset Multiple Emails"
Enabled: True
LogTypes:
- GitLab.Audit
Tags:
- GitLab
- CVE-2023-7028
- No Pack
Reports:
MITRE ATT&CK:
- TA0001:T1195
- TA0001:T1190
- TA0003:T1098
Severity: High
Description: Attackers are exploiting a Critical (CVSS 10.0) GitLab vulnerability in which user account password reset emails could be delivered to an unverified email address.
Reference: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/
Tests:
- Name: not a password reset
ExpectedResult: false
Log: { "detail": { "custom_message": "hello world" } }
- Name: one email
ExpectedResult: false
Log:
{
"detail":
{
"custom_message": "Ask for password reset",
"target_details": "example@test.com",
},
}
- Name: multiple emails
ExpectedResult: true
Log:
{
"detail":
{
"custom_message": "Ask for password reset",
"target_details": '["example@test.com", "example2@test.com"]',
},
}
Detection logic
Condition
detail.custom_message eq "Ask for password reset"
This rule also runs imperative logic the parser cannot express as a filter; the conditions above are the structured part it could extract.
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
detail.custom_message | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
target_details | detail.target_details |