Detection rules › Panther
CVE-2023-7028 - GitLab Production Password Reset Multiple Emails
Attackers are exploiting a Critical (CVSS 10.0) GitLab vulnerability in which user account password reset emails could be delivered to an unverified email address.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1190 Exploit Public-Facing Application, T1195 Supply Chain Compromise |
| Persistence | T1098 Account Manipulation |
Rule body yaml
AnalysisType: rule
Filename: gitlab_production_password_reset_multiple_emails.py
RuleID: "GitLab.Production.Password.Reset.Multiple.Emails"
DisplayName: "CVE-2023-7028 - GitLab Production Password Reset Multiple Emails"
Enabled: True
LogTypes:
- GitLab.Production
Tags:
- GitLab
- CVE-2023-7028
- No Pack
Reports:
MITRE ATT&CK:
- TA0001:T1195
- TA0001:T1190
- TA0003:T1098
Severity: High
Description: Attackers are exploiting a Critical (CVSS 10.0) GitLab vulnerability in which user account password reset emails could be delivered to an unverified email address.
Reference: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/
Tests:
- Name: not a password reset
ExpectedResult: false
Log:
{
params:
[
{ "key": "authenticity_token", "value": "[FILTERED]" },
{
"key": "user",
"value": { "email": ["peter@example.com", "bob@example.com"] },
},
],
"path": "/cats",
}
- Name: one email
ExpectedResult: false
Log:
{
params:
[
{ "key": "authenticity_token", "value": "[FILTERED]" },
{ "key": "user", "value": { "email": ["bob@example.com"] } },
],
"path": "/users/password",
}
- Name: multiple emails
ExpectedResult: true
Log:
{
params:
[
{ "key": "authenticity_token", "value": "[FILTERED]" },
{
"key": "user",
"value": { "email": ["peter@example.com", "bob@example.com"] },
},
],
"path": "/users/password",
}
Detection logic
Condition
path eq "/users/password"
params array_any
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
path | eq |
|
Output fields
Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.
| Field | Source |
|---|---|
target_details | detail.target_details |