PT-2022-24805 · Onedev · Onedev

Robinshine · Published 2022-09-13 · Updated 2022-10-01 · CVE-2022-39205

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Onedev versions prior to 7.3.0

Description The issue allows unauthenticated users to take over an Onedev instance if there is no properly configured reverse proxy. The "/git-prereceive-callback" endpoint, intended for localhost access, can be invoked by attackers, leading to the execution of git commands. Environment variables for this command execution can be controlled via query parameters, allowing attackers to write to arbitrary files and potentially execute arbitrary code. This attack is difficult to detect, increasing its potential impact.

Recommendations For versions prior to 7.3.0, upgrade to version 7.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/git-prereceive-callback" endpoint to minimize the risk of exploitation. Additionally, ensure a properly configured reverse proxy is in place to prevent unauthorized access.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-39205

GHSA-4F9H-H82C-4XM2

Affected Products

Onedev

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39205.json · Exploit
• 🔥 https://blog.sonarsource.com/onedev-remote-code-execution · Exploit
• https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e · Patch
• https://osv.dev/vulnerability/CVE-2022-39205 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39205 · Security Note
• https://github.com/theonedev/onedev/security/advisories/GHSA-4f9h-h82c-4xm2 · Note
• https://github.com/theonedev/onedev/releases/tag/v7.3.0 · Note