Critical · published September 13, 2022
🚨 Unauthenticated users can hijack your entire OneDev instance if reverse proxy settings aren’t just right! 🔥 Think of this like leaving a backdoor open in your office—one that only locals should use but ends up leading directly into your confidential files. If someone slips in unnoticed, they can wreak havoc without anyone realising! An attacker could seize control of your OneDev instance, execute arbitrary git commands, and write to any file they choose. This might lead to a complete system compromise that’s stealthy and hard to detect, leaving you blindsided and your data at risk. Yikes!
Think of this like leaving a backdoor open in your office—one that only locals should use but ends up leading directly into your confidential files. If someone slips in unnoticed, they can wreak havoc without anyone realising! In versions prior to 7.3.0, the /git-prereceive-callback endpoint incorrectly trusts the X-Forwarded-For header, allowing unauthenticated users to execute git commands and manipulate environment variables through query parameters.
An attacker could seize control of your OneDev instance, execute arbitrary git commands, and write to any file they choose. This might lead to a complete system compromise that’s stealthy and hard to detect, leaving you blindsided and your data at risk. Yikes! Upgrade to OneDev version 7.3.0 or later immediately. Ensure your reverse proxy settings are properly configured to block unauthorized access to critical endpoints. Since there are no known workarounds, timely action is essential! You've got this! Follow these steps and your OneDev instance will be safe and sound! 🛡️