CVE-2023-7028 - GitLab Production Password Reset Multiple Emails

AnalysisType: rule
Filename: gitlab_production_password_reset_multiple_emails.py
RuleID: "GitLab.Production.Password.Reset.Multiple.Emails"
DisplayName: "CVE-2023-7028 - GitLab Production Password Reset Multiple Emails"
Enabled: True
LogTypes:
  - GitLab.Production
Tags:
  - GitLab
  - CVE-2023-7028
  - No Pack
Reports:
  MITRE ATT&CK:
    - TA0001:T1195
    - TA0001:T1190
    - TA0003:T1098
Severity: High
Description: Attackers are exploiting a Critical (CVSS 10.0) GitLab vulnerability in which user account password reset emails could be delivered to an unverified email address.
Reference: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/
Tests:
  - Name: not a password reset
    ExpectedResult: false
    Log:
      {
        params:
          [
            { "key": "authenticity_token", "value": "[FILTERED]" },
            {
              "key": "user",
              "value": { "email": ["peter@example.com", "bob@example.com"] },
            },
          ],
        "path": "/cats",
      }
  - Name: one email
    ExpectedResult: false
    Log:
      {
        params:
          [
            { "key": "authenticity_token", "value": "[FILTERED]" },
            { "key": "user", "value": { "email": ["bob@example.com"] } },
          ],
        "path": "/users/password",
      }
  - Name: multiple emails
    ExpectedResult: true
    Log:
      {
        params:
          [
            { "key": "authenticity_token", "value": "[FILTERED]" },
            {
              "key": "user",
              "value": { "email": ["peter@example.com", "bob@example.com"] },
            },
          ],
        "path": "/users/password",
      }


# ------ paired body: gitlab_production_password_reset_multiple_emails.py ------

from panther_base_helpers import deep_get
from panther_core.immutable import ImmutableList


def rule(event):
    path = event.get("path", "")

    if path != "/users/password":
        return False

    params = event.get("params", [])
    for param in params:
        if param.get("key") == "user":
            email = deep_get(param, "value", "email", default=[])
            if isinstance(email, ImmutableList) and len(email) > 1:
                return True
    return False


def title(event):
    emails = event.deep_get("detail", "target_details", default="")
    return f"Someone tried to reset your password with multiple emails :{emails}"