oneDev Unauthorized Access Vulnerabilities: Fork/Parent Rebinding/Time Tracking Info Disclosure

Vulnerability Overview This page reports multiple vulnerabilities in oneDev BOPLA, all of which have been confirmed by the project owners. The following is a summary of the critical vulnerabilities: 1. Issue 01 — Unauthorized Cross-Project Repository Fork via - Risk Summary: Users who have permission to create projects within a namespace may be able to create a forked project where the references a source project that the user should not be able to read. - Impact Scope: The affected process includes copying repository data, LFS objects, commit metadata, and project avatar information from the source project to an attacker-controlled target project without enforcing source project read authorization. - Remediation: - Require explicit source project visibility and/or code read authorization before accepting the . - Add defensive validation within the actual fork service implementation. - Add regression tests: - "User can create a project" - But "User cannot read the source repository" 2. Issue 02 — Unauthorized Parent Project Rebinding via - Risk Summary: Users who can manage a project may be able to change the project's to another parent namespace where the user lacks permission. - Impact Scope: Once the parent relationship is changed, the project path, ancestor inheritance, inherited settings, and permission propagation chain may change accordingly. - Remediation: - Preserve the original parent relationship before mutating the entity. - Perform authorization checks before applying the new . - Add defensive validation within downstream project update logic. - Add regression tests: - "User can manage a project" - But "User cannot create a child project under the target namespace" 3. Issue 03 — Default Branch Modification Protected Only by - Risk Summary: The REST API used to change currently appears to require only permission. - Impact Scope: The default branch, as a project-level control plane attribute, affects workflow automation, branch selection logic, and default execution targets. - Remediation: - Align REST authorization semantics with Web UI behavior. - Require (or equivalent elevated control-plane permissions). - Review other project-level control attributes for similar permission inconsistencies. 4. Issue 04 — Pull Request Modification Capability Delegation via Arbitrary Assignee - Risk Summary: Delegation of pull request modification capability through arbitrary assignees. - Impact Scope: This may lead to pull requests being modified by unauthorized users. - Remediation: No specific remediation provided. 5. Issue 05 — Unauthorized Exposure of Time-Tracking Information via Issue REST APIs - Risk Summary: Issue time-tracking information appears to be exposed via the REST API to users who can access the issue itself, even if these users do not have dedicated time-tracking visibility permissions. - Impact Scope: Exposed information includes aggregated time statistics and detailed worklog entries. - Remediation: - Require before returning the issue object and worklog collection. - Hide or omit time-tracking fields when the caller lacks the corresponding permissions. - Align REST behavior with existing UI/service-layer authorization semantics. Impact Scope Issue 01: May lead to unauthorized project duplication and metadata leakage. Issue 02: May lead to the disruption of project hierarchy and namespace boundary enforcement. Issue 03: May lead to unauthorized modification of the default branch, affecting workflow automation. Issue 04: May lead to unauthorized modification of pull requests. Issue 05: May lead to the unauthorized exposure of time-tracking information, affecting sensitive operational details such as team workload distribution, work planning, and collaboration patterns. Remediation Issue 01: Require explicit source project visibility and/or code read authorization; add defensive validation and regression tests. Issue 02: Preserve the original parent relationship; perform authorization checks; add defensive validation and regression tests. Issue 03: Align REST authorization semantics with Web UI behavior; require higher privileges; review other control attributes. Issue 04: No specific remediation provided. Issue 05: Require ; hide or omit time-tracking fields; align REST behavior. POC Code or Exploit Code No specific POC code or exploit code was provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

oneDev Unauthorized Access Vulnerabilities: Fork/Parent Rebinding/Time Tracking Info Disclosure