PT-2022-24808 · Onedev · Onedev

Paul Gerste · Published 2022-09-13 · Updated 2022-10-01 · CVE-2022-39208

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Onedev versions prior to 7.3.0

Description Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be read by unauthenticated users. This directory contains all projects, including their bare git repos and build artifacts. This issue can be used by unauthenticated attackers to leak all project files of any project. Since project IDs are incremental, an attacker could iterate through them and leak all project data.

Recommendations For versions prior to 7.3.0, upgrade to version 7.3.0 to resolve the issue. As a temporary workaround, consider restricting access to the /opt/onedev/sites/ directory until the upgrade is applied.

Exploit

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2022-39208

GHSA-H427-RV56-C9H2

Affected Products

Onedev

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39208.json · Exploit
• 🔥 https://blog.sonarsource.com/onedev-remote-code-execution · Exploit
• https://github.com/theonedev/onedev/commit/8aa94e0daf8447cdf76d4f27bfda0a85a7ea5822 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-39208 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39208 · Vendor Advisory
• https://github.com/theonedev/onedev/security/advisories/GHSA-h427-rv56-c9h2 · Note
• https://t.me/cibsecurity/49696 · Telegram Post