Real World GitLab Account Take Over

An attacker managed to exploit a vulnerability in GitLab, taking over accounts of a company that provides VoIP solutions, including government organizations, banks, and telecom providers. The post describes the reconnaissance process, the GitLab enumeration, the specific vulnerability (CVE-2023-7028), and the exploitation process. The attacker harvested email addresses of the company's employees to carry out the account takeover. Once inside, they gained access to all company projects and extracted API keys and credentials.