CVE-2024-45309 Scanner
CVE-2024-45309 Scanner - Arbitrary File Read vulnerability in OneDev.io
Short Info
Level
High
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
18 days 12 hours
Scan only one
Domain, IPv4
Toolbox
-
OneDev is an open-source all-in-one development platform designed for source code management, issue tracking, and CI/CD pipelines. It is commonly used by software development teams to streamline project management and enhance productivity. The software provides features like code review, task management, and version control, making it a vital tool in collaborative development environments.
Arbitrary File Read vulnerabilities allow attackers to access files on the host system that they would not typically be authorized to view. This vulnerability occurs due to improper validation of directory traversal characters in file paths, enabling unauthorized file access. Attackers can exploit this flaw to retrieve sensitive system files or application configurations.
In OneDev, the vulnerability stems from inadequate sanitization of file path inputs in certain endpoints. By sending specially crafted requests with directory traversal sequences (`../../..`), attackers can navigate outside the intended directory structure and access sensitive files like `/etc/passwd` or `win.ini`. The flaw affects versions below 11.0.9.
Exploitation of this vulnerability may lead to the exposure of sensitive information, such as system configurations, user credentials, or application secrets. This could facilitate further attacks, including privilege escalation, unauthorized access, or system compromise.
REFERENCES