1
2name: crowdsecurity/vpatch-CVE-2023-7028
3description: "Gitlab Password Reset Account Takeover (CVE-2023-7028)"
4rules:
5  - and:
6    - zones:
7      - URI
8      transform:
9      - lowercase
10      match:
11        type: endsWith
12        value: /users/password
13    - zones:
14      - METHOD
15      match:
16        type: equals
17        value: POST
18    - zones:
19      - BODY_ARGS
20      variables:
21      - 'user[email][]'
22      transform:
23      - count
24      match:
25        type: gte
26        value: 2
27labels:
28  type: exploit
29  service: http
30  confidence: 3
31  spoofable: 0
32  behavior: "http:exploit"
33  label: "GitLab - Account Takeover"
34  classification:
35   - cve.CVE-2023-7028
36   - attack.T1595
37   - attack.T1190