mad3E7cat/CVE-2023-5612

GitHubRepository PoCWriteup

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup describing CVE-2023-5612, an information disclosure vulnerability in GitLab that leaks user emails via the tags RSS feed. The document explains the vulnerability, provides HTTP request/response examples, and references external exploit code (Metasploit module, NSE script) but does not contain its own executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence is a README.md documentation file describing the CVE-2023-5612 vulnerability in GitLab. It contains no executable code, no instructions to run a PoC, and no concealed or deceptive payload. The file explains the vulnerability, provides example HTTP requests and responses, and references external tools (Metasploit, NSE script) for exploitation, but does not itself perform any actions.

ClassificationWriteup
Model confidence98%
AuthenticationNot required
LanguagesMarkdownRussian
Target softwareGitLab
Attack typesInformation Disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that explains the vulnerability, provides manual steps and example HTTP interactions, and references external exploit code. It does not contain any executable code itself; it is a technical analysis and documentation, i.e., a writeup.

README.md:1-211

Requirements

  • Target must be a GitLab instance with accessible projects and tags.README.md:13

Observed behavior

  • Describes fetching project list via /api/v4/projects and then retrieving tags in Atom format to extract author names and emails.README.md:30-67
  • Shows example output of a Metasploit module and an NSE script, but the artifact itself does not contain the code for these tools.README.md:69-87README.md:139-171
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Documentation Only
README.mdThe entire artifact is a single Markdown file containing vulnerability description, examples, and links. No executable code or backdoor behavior is present.README.md:1-211
Review boundaries

What the analysis did not establish

  • Only one of three text files (README.md) was included; the other two files are omitted, so any code they might contain is not available for analysis.
  • The artifact references external exploit code (Metasploit module, NSE script) but does not include it, so the classification is based solely on the provided README content.
  • Two additional files in the repository were not included in the evidence packet and were not analyzed. Their content is unknown.
  • The analysis is limited to the supplied text; no dynamic or behavioral analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2023-5612Compose · images

1 Compose manifest · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-service Docker Compose environment running GitLab CE 16.5.10, intended as a vulnerable target for CVE-2023-5612 email disclosure testing.

docker-compose.yml:1-19README.md:1-211

Lab assessment

Vulnerability lab

The README explicitly describes CVE-2023-5612, provides a vulnerable GitLab version (16.5.10), and includes a docker-compose.yml to set up the target for exploitation and testing.

README.md:1-10README.md:60-80
Lab shapeCompose · images
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

gitlab

vulnerable target

GitLab CE 16.5.10 service exposed on host ports 8929, 443, and 2424, with persistent volumes for config, logs, and data. It is the target for CVE-2023-5612 email disclosure via tags RSS feed.

docker-compose.yml:2-18README.md:60-80
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-5612

Supported by supplied evidence

The README describes the vulnerability (email disclosure via tags RSS feed), references the official GitLab advisory and NVD entry, and provides a vulnerable version (16.5.10) and exploit steps that match the CVE description.

README.md:1-10README.md:60-80README.md:12-30
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.README.md:82-84
  • GitLab CE 16.5.10 container running and accessible on localhost:8929.docker-compose.yml:2-12README.md:82-84
  • Root password retrieved from container logs and changed.README.md:85-88
  • Projects and tags created in GitLab by users (root and test) to have data for the exploit.README.md:90-95
  • Nmap with the custom NSE script (cve-2023-5612.nse) or Metasploit module for exploitation.README.md:97-100README.md:55-58

Evidence-described exercise path

  1. Start the vulnerable GitLab container using docker compose up.README.md:82-84
  2. Retrieve the initial root password from the container logs.README.md:85-86
  3. Log in as root, change credentials, create a project and a tag.README.md:90-95
  4. Create a user 'test', log in, create a project and a tag.README.md:90-95
  5. Run the NSE script or Metasploit module against the target to enumerate emails.README.md:97-100README.md:55-58
  6. Verify extracted emails from the output or CSV file.README.md:101-120
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab targeting a local GitLab instance. No evidence of host escape, external connections, persistence, credential theft, or destructive behavior beyond the intended exploit demonstration.

docker-compose.yml:1-19README.md:1-211
Review boundaries

What the analysis did not establish

  • The NSE script (cve-2023-5612.nse) is a binary file and was not inspected; its behavior cannot be confirmed.
  • The README mentions a Metasploit module but does not include it; its behavior is not verified.
  • The docker-compose.yml uses host port mappings and volume mounts, which are necessary for the lab but could be misused if the host environment is not properly isolated.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1