Knowledge Hub

GitLab CVE-2023-7028

TryHackMe4 answered prompts

GitLab CVE-2023-7028 TryHackMe walkthrough with 4 answered prompts.

Prompts and answers

  • What is the name of the field that is sent with a password reset request to prevent CSRF attacks?
    authenticity_token
  • What is the HTTP method used while sending password reset requests in GitLab?
    POST
  • Per the above code, what is the API endpoint for getting an updated authenticity token?
    /users/password/new
  • What is the flag value after successfully sending password reset mail through attack.py?
    account_hack#d