{"id":"CVE-2022-39205","summary":"Access Control Bypass in Onedev","details":"Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used by the pre-receive git hook on the server to check for branch protections during a push event. It is only intended to be accessed from localhost, but the check relies on the X-Forwarded-For header. Invoking this endpoint leads to the execution of one of various git commands. The environment variables of this command execution can be controlled via query parameters. This allows attackers to write to arbitrary files, which can in turn lead to the execution of arbitrary code. Such an attack would be very hard to detect, which increases the potential impact even more. Users are advised to upgrade. There are no known workarounds for this issue.","aliases":["GHSA-4f9h-h82c-4xm2"],"modified":"2026-08-12T13:33:10.566312Z","published":"2022-09-13T18:30:13Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39205.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-287"]},"references":[{"type":"WEB","url":"https://github.com/theonedev/onedev/releases/tag/v7.3.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39205.json"},{"type":"ADVISORY","url":"https://github.com/theonedev/onedev/security/advisories/GHSA-4f9h-h82c-4xm2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39205"},{"type":"FIX","url":"https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e"},{"type":"ARTICLE","url":"https://blog.sonarsource.com/onedev-remote-code-execution/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/theonedev/onedev","events":[{"introduced":"0"},{"fixed":"83b09b15f7f4c1fdde22d0f7d0e13d2f561c731f"},{"fixed":"f1e97688e4e19d6de1dfa1d00e04655209d39f8e"}],"database_specific":{"cpe":"cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"7.3.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v7.2.9","v7.2.8","v7.2.7","v7.2.5","v7.2.4","v7.2.3","v7.2.2","v7.2.1","v7.2.0","v7.1.8","v7.1.7","v7.1.6","v7.1.3","v7.1.2","v7.1.1","v7.1.0","v7.0.3","v7.0.2","v7.0.1","v7.0.0","v6.3.13","v6.3.12","v6.3.11","v6.3.10","v6.3.9","v6.3.8","v6.3.7","v6.3.6","v6.3.5","v6.3.4","v6.3.3","v6.3.2","v6.3.1","v6.3.0","v6.2.4","v6.2.3","v6.2.2","v6.2.1","v6.2.0","v6.1.4","v6.1.3","v6.1.2","v6.1.1","v6.1.0","v6.0.0","v5.4.0","v5.3.3","v5.3.1","v5.3.0","v5.2.2","v5.2.1","v5.2.0","v5.1.0","v5.0.1","v5.0.0","v4.11.0","v4.10.3","v4.9.2","v4.9.1","v4.9.0","v4.8.1","v4.8.0","v4.7.0","v4.6.1","v4.6.0","v4.4.3","v4.4.2","v4.4.1","v4.4.0","v4.3.2","v4.3.0","v4.2.5","v4.2.4","v4.2.3","v4.2.2","v4.2.1","v4.2.0","v4.1.6","v4.1.5","v4.1.4","v4.1.3","v4.1.2","v4.1.0","v4.0.9","v4.0.8","v4.0.7","v4.0.6","v4.0.5","v4.0.4","v4.0.3","v4.0.2","v4.0.1","v4.0.0","v3.2.4","v3.2.3","v3.2.2","v3.2.1","v3.2.0","v3.1.2","v3.1.1","v3.1.0","v3.0.10","v3.0.9","v3.0.8","v3.0.7","v3.0.6","v3.0.5","v3.0.4","2.0.5","2.0.4","2.0.0","2.0-beta-build120","2.0-beta-build119"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-39205.json","vanir_signatures_modified":"2026-08-12T13:33:10Z","vanir_signatures":[{"target":{"function":"processPacks","file":"server-core/src/main/java/io/onedev/server/git/GitFilter.java"},"deprecated":false,"digest":{"function_hash":"136769484524171149304535679117003902181","length":3404},"id":"CVE-2022-39205-135b003b","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e","target":{"file":"server-core/src/main/java/io/onedev/server/entitymanager/impl/DefaultProjectManager.java"},"deprecated":false,"digest":{"line_hashes":["47350834109814006696040028037083887320","219618327198003358174359719637548999764","89181660272771497624737785679861116290","207497375148261362967820633445460472824"],"threshold":0.9},"id":"CVE-2022-39205-250155af"},{"source":"https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e","target":{"file":"server-core/src/main/java/io/onedev/server/git/GitUtils.java"},"deprecated":false,"digest":{"line_hashes":["147970592967384382496776942734709039878","163645671243994660800766011349510966851","19969886352476799363305059712316087708","202249125843499403579981595706234470907","314181751973648522147484512036789771610","76924456654331761157082441368756735569"],"threshold":0.9},"id":"CVE-2022-39205-25152251","signature_type":"Line","signature_version":"v1"},{"target":{"file":"server-core/src/main/java/io/onedev/server/git/hookcallback/GitPostReceiveCallback.java","function":"doPost"},"deprecated":false,"digest":{"function_hash":"250315223260822572563997714801641666204","length":2625},"id":"CVE-2022-39205-47c3c96b","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e"},{"signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e","target":{"file":"server-core/src/main/java/io/onedev/server/git/GitFilter.java"},"deprecated":false,"digest":{"line_hashes":["23947365262268625309203846942324987814","25350609611278901294957088789027688432","190566516875660108003211421087539325938","2317806168754823543127108035743500341"],"threshold":0.9},"id":"CVE-2022-39205-55b26a56","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["325761650724564080935948866957942857935","5999877330398834271953031568471981122","309679362781290208090193901677124057797","258697094797436903889052579686616869426","309258201483361563177891043731278259672","143797777139779684141914249605486867786","13426608607419614053386974681022716686","33022311146080260654126173275072192111","8369052064925222043328303350303700867","23629117372459117080917654373706073598","241826671307397847603110967054335689704","169287997275911854351068250089579732328","102376623588748711412142601827230285725","81838790876670044543288922383360148783","284461624349913966106101199551810787463"],"threshold":0.9},"id":"CVE-2022-39205-743c0ac8","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e","target":{"file":"server-core/src/main/java/io/onedev/server/git/hookcallback/GitPostReceiveCallback.java"}},{"digest":{"threshold":0.9,"line_hashes":["325761650724564080935948866957942857935","5999877330398834271953031568471981122","81285239198460080913184297246869329254","258697094797436903889052579686616869426","309258201483361563177891043731278259672","143797777139779684141914249605486867786","13426608607419614053386974681022716686","33022311146080260654126173275072192111","8369052064925222043328303350303700867","23629117372459117080917654373706073598","241826671307397847603110967054335689704","169287997275911854351068250089579732328","73381883692528213227913898945619203142","22223065342900779820036937213607267914","203824940689630759334146081101462535275"]},"id":"CVE-2022-39205-a6a57326","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e","target":{"file":"server-core/src/main/java/io/onedev/server/git/hookcallback/GitPreReceiveCallback.java"},"deprecated":false},{"target":{"file":"server-core/src/main/java/io/onedev/server/git/GitSshCommand.java"},"deprecated":false,"digest":{"line_hashes":["286773359586466741565287973623260133844","300273700216117484939155725332815145600","25350609611278901294957088789027688432","89889992733018390341650803170535544068"],"threshold":0.9},"id":"CVE-2022-39205-a6cb767a","signature_type":"Line","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e","target":{"file":"server-core/src/main/java/io/onedev/server/git/hookcallback/GitPreReceiveCallback.java","function":"doPost"},"deprecated":false,"digest":{"function_hash":"234754666325921484316299207046642481337","length":5352},"id":"CVE-2022-39205-d41affd9"},{"target":{"file":"server-core/src/main/java/io/onedev/server/git/GitSshCommand.java","function":"buildGitEnvs"},"deprecated":false,"digest":{"function_hash":"247263592681375402671315584429789639815","length":620},"id":"CVE-2022-39205-df1a1de8","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e"},{"id":"CVE-2022-39205-f4ccfbea","signature_type":"Function","signature_version":"v1","source":"https://github.com/theonedev/onedev/commit/f1e97688e4e19d6de1dfa1d00e04655209d39f8e","target":{"function":"isGitHookValid","file":"server-core/src/main/java/io/onedev/server/entitymanager/impl/DefaultProjectManager.java"},"deprecated":false,"digest":{"function_hash":"258258401466603869882499669848606849562","length":414}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}]}