A vulnerability classified as critical was found in Onedev up to 7.2.x. This vulnerability affects an unknown code of the file /var/run/docker.sock of the component Docker Socket Handler. The manipulation with an unknown input leads to a external reference vulnerability. The CWE definition for the vulnerability is CWE-610. The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on Linux) is mounted into each Docker step. Users that can define and trigger CI/CD jobs on a project could use this to control the Docker daemon on the host machine. This is a known dangerous pattern, as it can be used to break out of Docker containers and, in most cases, gain root privileges on the host system. This issue allows regular (non-admin) users to potentially take over the build infrastructure of a OneDev instance. Attackers need to have an account (or be able to register one) and need permission to create a project. Since code.onedev.io has the right preconditions for this to be exploited by remote attackers, it could have been used to hijack builds of OneDev itself, e.g. by injecting malware into the docker images that are built and pushed to Docker Hub. The impact is increased by this as described before. Users are advised to upgrade to 7.3.0 or higher. There are no known workarounds for this issue.

The weakness was released 09/14/2022 as GHSA-gjq9-4xx9-cr3q. The advisory is shared for download at github.com. This vulnerability was named CVE-2022-39206 since 09/02/2022. There are known technical details, but no exploit is available.

Upgrading to version 7.3.0 eliminates this vulnerability. Applying the patch 0052047a5b5095ac6a6b4a73a522d0272fec3a22 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Productinfo

Name

• Onedev

Version

• 7.0
• 7.1
• 7.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion