CyberSecBulletin
CVE-2022-39206NVD status: Modified

onedev: Externally Controlled Reference to a Resource in Another Sphere

Published Updated By the CyberSecBulletin desk

CVE-2022-39206 is a critical-severity externally controlled reference to a resource in another sphere vulnerability in onedev from Theonedev, with a CVSS 3.1 base score of 9.9 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. Affected onedev versions: < 7.3.0. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 2.19% chance of exploitation within 30 days, higher than 83% of scored CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Check which version of onedev you run against the affected versions below, and install the vendor's latest release.
  2. Read the advisory on github.com for workarounds and exact fixed builds.

Affected products and versions

VendorProductAffected versionsFixed in
Theonedevonedev< 7.3.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
ChangedThe attack can reach beyond the vulnerable component into other systems.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 3.19.9CriticalCNA (github.com)
CVSS 3.19.9CriticalNVD

Official description

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on Linux) is mounted into each Docker step. Users that can define and trigger CI/CD jobs on a project could use this to control the Docker daemon on the host machine. This is a known dangerous pattern, as it can be used to break out of Docker containers and, in most cases, gain root privileges on the host system. This issue allows regular (non-admin) users to potentially take over the build infrastructure of a OneDev instance. Attackers need to have an account (or be able to register one) and need permission to create a project. Since code.onedev.io has the right preconditions for this to be exploited by remote attackers, it could have been used to hijack builds of OneDev itself, e.g. by injecting malware into the docker images that are built and pushed to Docker Hub. The impact is increased by this as described before. Users are advised to upgrade to 7.3.0 or higher. There are no known workarounds for this issue.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Externally Controlled Reference to a Resource in Another Sphere

The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.

More Externally Controlled Reference to a Resource in Another Sphere vulnerabilities (CWE-610)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: poc, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Technical write-ups (may include proof of concept)

Other vulnerabilities in onedev

All onedev vulnerabilities

Recent Externally Controlled Reference to a Resource in Another Sphere vulnerabilities

Spotted an error? Tell us.