CVE-2024-45309
HIGH EXPLOITED NUCLEIOneDev Unauthenticated Arbitrary File Read
Title source: metasploitExploitation Summary
CVE-2024-45309 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 1 public exploit from researchers including vultza, Siebene, including a Metasploit module auxiliary/gather/onedev_arbitrary_file_read.
A Nuclei detection template is also available.
AI-analyzed exploit summary This Metasploit module exploits CVE-2024-45309, an unauthenticated arbitrary file read vulnerability in OneDev <= 11.0.8. It uses path traversal to read files from the server, with optional brute-forcing of project names if anonymous access is disabled.
Description
OneDev is a Git server with CI/CD, kanban, and packages. A vulnerability in versions prior to 11.0.9 allows unauthenticated users to read arbitrary files accessible by the OneDev server process. This issue has been fixed in version 11.0.9.
Exploits (1)
This Metasploit module exploits CVE-2024-45309, an unauthenticated arbitrary file read vulnerability in OneDev <= 11.0.8. It uses path traversal to read files from the server, with optional brute-forcing of project names if anonymous access is disabled.
Nuclei Templates (1)
html:"onedev.io"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N