PT-2024-7509 · Onedev · Onedev

Robinshine · Published 2024-08-26 · Updated 2025-01-13 · CVE-2024-45309

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 11.0.9

Description: A vulnerability in OneDev allows unauthenticated users to read arbitrary files accessible by the OneDev server process. This issue has been fixed in version 11.0.9. The vulnerability is related to insufficient protection of internal data, which could allow a remote attacker to read arbitrary files, potentially exposing sensitive information.

Recommendations: For versions prior to 11.0.9, update to version 11.0.9 to patch this issue. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation. Avoid using the OneDev server process to access sensitive files until the issue is resolved.

Exploit

Fix

Path traversal

Information Disclosure

Weakness Enumeration

CWE-22

CWE-200

Related Identifiers

BDU:2024-08898

CVE-2024-45309

GHSA-7WG5-6864-V489

Affected Products

Onedev

References · 23

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/onedev_arbitrary_file_read.rb · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45309.json · Exploit
• https://github.com/theonedev/onedev/commit/4637aaac8c70d41aa789b7fce208b75c6a7b711f · Patch
• https://osv.dev/vulnerability/CVE-2024-45309 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08898 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-45309 · Security Note
• https://github.com/theonedev/onedev/security/advisories/GHSA-7wg5-6864-v489 · Note
• https://asec.ahnlab.com/en/84118 · Note
• https://twitter.com/zoomeye_team/status/1848671643889242318 · Twitter Post
• https://t.me/cvedetector/8499 · Telegram Post
• https://vuldb.com/?id.281137 · Note
• https://twitter.com/Hossted_OSS/status/1853364076446961681 · Twitter Post
• https://t.me/pentestingnews/52533 · Telegram Post
• https://twitter.com/Raj_Samani/status/1878744472969957699 · Twitter Post
• https://twitter.com/CveFindCom/status/1848379559369982187 · Twitter Post