PT-2022-24806 · Onedev · Onedev

Robinshine · Published 2022-09-13 · Updated 2022-10-01 · CVE-2022-39206

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Onedev versions prior to 7.3.0

Description Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket is mounted into each Docker step, allowing users who can define and trigger CI/CD jobs to control the Docker daemon on the host machine. This can be used to break out of Docker containers and gain root privileges on the host system, potentially taking over the build infrastructure of a OneDev instance. Attackers need an account and permission to create a project to exploit this issue. The impact is increased as it could be used to hijack builds of OneDev itself by injecting malware into docker images built and pushed to Docker Hub.

Recommendations Upgrade to Onedev version 7.3.0 or higher. There are no known workarounds for this issue.

Exploit

Fix

Weakness Enumeration

CWE-610

Related Identifiers

CVE-2022-39206

GHSA-GJQ9-4XX9-CR3Q

Affected Products

Onedev

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39206.json · Exploit
• 🔥 https://blog.sonarsource.com/onedev-remote-code-execution · Exploit
• https://github.com/theonedev/onedev/commit/0052047a5b5095ac6a6b4a73a522d0272fec3a22 · Patch
• https://osv.dev/vulnerability/CVE-2022-39206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-39206 · Security Note
• https://github.com/theonedev/onedev/security/advisories/GHSA-gjq9-4xx9-cr3q · Note
• https://t.me/cibsecurity/49709 · Telegram Post