Executive Summary

This vulnerability exists in OneDev, a Git server with CI/CD, kanban, and packages, specifically in versions 15.0.6 and below. The issue is in the TarUtils.untar() function, which creates symbolic links from TAR archive entries without validating if the target path is absolute. Because of this, a subsequent file entry in the same archive can traverse the symlink and write files to arbitrary locations on the server.

This flaw can be exploited by any authenticated user who has CI Job write access, and it does not require any administrator interaction. It is a bypass of a previous fix (CVE-2021-21251) that only blocked relative path traversal (.. segments) but did not address absolute symlink targets. The vulnerability was fixed in version 15.0.7.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with CI Job write access to write files to arbitrary locations on the server by exploiting symbolic links in TAR archives. This can lead to unauthorized modification or overwriting of critical files on the server, potentially compromising the integrity and security of the system.

Since no administrator interaction is required, the risk is higher for environments where multiple users have CI Job write permissions. The attacker could use this to escalate privileges, disrupt services, or implant malicious files.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been fixed in OneDev version 15.0.7. Immediate mitigation involves upgrading OneDev to version 15.0.7 or later.

Since the vulnerability allows any authenticated user with CI Job write access to exploit it, restricting or reviewing CI Job write permissions can reduce risk until the upgrade is applied.

Useful 0 Not Useful 0