CVE-2024-45309: OneDev Information Disclosure Flaw

CVE-2024-45309 Overview

CVE-2024-45309 is a path traversal vulnerability in OneDev, an open-source Git server with built-in CI/CD, kanban, and package management features. Versions prior to 11.0.9 allow unauthenticated remote attackers to read arbitrary files accessible to the OneDev server process. The flaw is exposed over the network with no authentication or user interaction required. The maintainers fixed the issue in version 11.0.9. The vulnerability is tracked under [CWE-22] (Path Traversal) and [CWE-200] (Exposure of Sensitive Information).

Critical Impact
Unauthenticated attackers can read sensitive files from the OneDev host, including configuration files, source code, SSH keys, and credentials accessible to the server process.

Affected Products

OneDev versions prior to 11.0.9
Self-hosted OneDev Git server deployments
OneDev container and Docker-based installations

Discovery Timeline

2024-10-21 - CVE-2024-45309 published to NVD
2024-11-14 - Last updated in NVD database

Technical Details for CVE-2024-45309

Vulnerability Analysis

The vulnerability allows unauthenticated users to retrieve arbitrary files from the OneDev server's filesystem. Because the OneDev process typically runs with elevated privileges to manage Git repositories, build artifacts, and pipeline state, accessible files often include credentials, repository data, and CI/CD secrets. The Exploit Prediction Scoring System (EPSS) places this issue in the upper percentile of exploitation likelihood, indicating active interest from threat actors.

Successful exploitation yields information disclosure only; the underlying weakness does not directly grant code execution. However, leaked secrets such as Git server tokens, database credentials, or signing keys can be chained to escalate access into source repositories and CI/CD pipelines.

Root Cause

The root cause is improper validation of user-controlled path input in an HTTP endpoint exposed by the OneDev server. The application does not adequately constrain requested file paths to a permitted directory, allowing traversal sequences to resolve outside the intended root. The upstream fix is implemented in commit 4637aaac, which tightens path handling and rejects requests that escape the allowed scope.

Attack Vector

An attacker sends a crafted HTTP request to a publicly reachable OneDev instance. No credentials are required, and exploitation requires only a single network request. Attackers can iterate through paths such as application configuration files, Git repository internals, the OneDev installation directory, user home directories, and Linux system files like /etc/passwd to enumerate the host and harvest secrets.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-7wg5-6864-v489. No verified public proof-of-concept exploit code is referenced in the advisory.

Detection Methods for CVE-2024-45309

Indicators of Compromise

HTTP request logs containing path traversal sequences such as ../, ..%2f, or encoded variants targeting OneDev endpoints.
Unauthenticated requests returning sensitive file content with 200 OK responses and unusually large response bodies.
Access patterns referencing system paths such as /etc/passwd, id_rsa, application.properties, or OneDev config files.
Repeated requests from a single source enumerating multiple file paths in short succession.

Detection Strategies

Inspect OneDev access logs for requests containing directory traversal patterns and decoded variants.
Deploy web application firewall (WAF) rules to flag traversal sequences on URIs served by the OneDev application.
Compare the running OneDev version against 11.0.9 using asset inventory data and flag any earlier installations.
Monitor outbound connections from the OneDev host immediately following suspicious inbound requests to identify follow-on credential abuse.

Monitoring Recommendations

Forward OneDev and reverse proxy logs to a centralized SIEM for correlation against threat intelligence on this CVE.
Alert on access to sensitive files on the OneDev host, particularly key material in ~/.ssh/ and configuration files containing secrets.
Track authentication anomalies on downstream systems whose credentials are stored on the OneDev server.

How to Mitigate CVE-2024-45309

Immediate Actions Required

Upgrade all OneDev installations to version 11.0.9 or later without delay.
Restrict network exposure of OneDev to trusted networks or VPN until patching is complete.
Rotate credentials, tokens, SSH keys, and signing material stored on or accessible to the OneDev server, assuming potential exposure.
Review access logs for the period preceding the upgrade to identify possible exploitation attempts.

Patch Information

The vendor released the fix in OneDev 11.0.9. The corrective change is available in upstream commit 4637aaac8c70d41aa789b7fce208b75c6a7b711f. Administrators should follow the standard OneDev upgrade procedure for their deployment method (JAR, Docker, or Kubernetes) and verify the running version after restart.

Workarounds

Place OneDev behind a reverse proxy or WAF configured to reject requests containing path traversal sequences in URIs and query parameters.
Run the OneDev process under a dedicated, least-privileged service account with filesystem access limited to required directories.
Block public internet access to the OneDev web interface using network ACLs or firewall rules until the upgrade is applied.

bash

# Example: verify installed OneDev version and upgrade via Docker
docker inspect onedev --format '{{.Config.Image}}'
docker pull 1dev/server:11.0.9
docker stop onedev && docker rm onedev
docker run -d --name onedev \
  -v /var/onedev:/opt/onedev \
  -p 6610:6610 -p 6611:6611 \
  1dev/server:11.0.9