CVE-2024-45309 Scanner

CVE-2024-45309 Scanner - Arbitrary File Read vulnerability in OneDev.io

Short Info


Level

High

Single Scan

Single Scan

Can be used by

Asset Owner

Estimated Time

10 seconds

Time Interval

18 days 12 hours

Scan only one

Domain, IPv4

Toolbox

-

OneDev is an open-source all-in-one development platform designed for source code management, issue tracking, and CI/CD pipelines. It is commonly used by software development teams to streamline project management and enhance productivity. The software provides features like code review, task management, and version control, making it a vital tool in collaborative development environments.

Arbitrary File Read vulnerabilities allow attackers to access files on the host system that they would not typically be authorized to view. This vulnerability occurs due to improper validation of directory traversal characters in file paths, enabling unauthorized file access. Attackers can exploit this flaw to retrieve sensitive system files or application configurations.

In OneDev, the vulnerability stems from inadequate sanitization of file path inputs in certain endpoints. By sending specially crafted requests with directory traversal sequences (`../../..`), attackers can navigate outside the intended directory structure and access sensitive files like `/etc/passwd` or `win.ini`. The flaw affects versions below 11.0.9.

Exploitation of this vulnerability may lead to the exposure of sensitive information, such as system configurations, user credentials, or application secrets. This could facilitate further attacks, including privilege escalation, unauthorized access, or system compromise.

REFERENCES

Get started to protecting your Free Full Security Scan