Trackflaw/CVE-2023-7028-Docker

GitHubRepository PoC

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub

Docker lab environments

1
GitHub

docker-compose.yml

Created Vuln labCVE-2023-7028Compose · images

1 Compose manifest · 1 service

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment that deploys a single GitLab Community Edition 16.1.4 instance, configured with SMTP settings and a known root password, intended as a lab to practice exploiting CVE-2023-7028.

docker-compose.yml:1-30README.md:1-29

Lab assessment

Vulnerability lab

The README explicitly states the purpose is to practice with the new GitLab CVE (CVE-2023-7028) and provides build and PoC instructions. The Docker Compose file deploys a specific vulnerable GitLab version (16.1.4-ce.0) with a known root password, consistent with a vulnerability reproduction environment.

README.md:1-3docker-compose.yml:6
Lab shapeCompose · images
Services1
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

gitlab

vulnerable target application

A GitLab CE 16.1.4-ce.0 service configured with SMTP settings, a known root password (Tr4ckfl4w4th3W1n), and exposed on ports 80, 443, and 22. It mounts local directories for config, logs, and data persistence.

docker-compose.yml:5-29
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2023-7028

Supported by supplied evidence

The README explicitly identifies the lab as for practicing CVE-2023-7028, and the Docker Compose file deploys GitLab CE 16.1.4-ce.0, a version known to be affected by this CVE. The configuration includes SMTP settings, which are relevant to the vulnerability's attack vector (password reset via email).

README.md:1-3docker-compose.yml:6
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed on the host.README.md:7
  • The repository must be cloned from GitHub.README.md:8
  • SMTP settings in docker-compose.yml must be configured with valid credentials.README.md:10
  • The external_url and hostname must be changed to the user's domain.README.md:11
  • A user account with a valid email address must be created on the GitLab instance to serve as the target for compromise.README.md:14

Evidence-described exercise path

  1. Install Docker.README.md:7
  2. Clone the project repository.README.md:8
  3. Navigate to the project directory.README.md:9
  4. Configure SMTP settings in docker-compose.yml.README.md:10
  5. Change external_url and hostname to the user's domain.README.md:11
  6. Launch the Docker Compose environment in detached mode.README.md:12
  7. Connect to http://localhost and log in as admin with the provided password.README.md:13
  8. Create a target user account with a valid email address.README.md:14
  9. Use an automated PoC (e.g., from Vozec/CVE-2023-7028 or V1lu0/CVE-2023-7028) to exploit the vulnerability.README.md:22-24
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The environment is a self-contained vulnerability lab. It deploys a single GitLab service with bind mounts for persistence and exposes standard GitLab ports. There is no evidence of hidden behavior, host escape, external connections beyond the documented SMTP configuration, or any destructive actions. The known root password and SMTP settings are explicitly provided for lab setup and are not hidden.

docker-compose.yml:1-30README.md:1-29
Review boundaries

What the analysis did not establish

  • The packet contains only a Docker Compose file and a README; no exploit code or additional scripts are included.
  • The SMTP configuration in docker-compose.yml uses placeholder values (smtp_address, smtp_user_name, smtp_password) that must be replaced by the user, but the file itself does not contain real credentials.
  • The README references external PoC repositories and a blog, but their content is not part of this evidence packet.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1