CVE-2023-24828 Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev

What is CVE-2023-24828?

CVE-2023-24828 is a high-severity vulnerability in theonedev onedev, published on 7 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may exploit this to elevate privilege to obtain administrator permission. This issue is has been addressed in version 7.9.12. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-338

Which versions are affected by CVE-2023-24828?

It affects 1 product.

Products include Onedev Project Onedev.

How do I fix CVE-2023-24828?

No fix has been published for CVE-2023-24828 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-24828 being exploited?

There is no known exploitation of CVE-2023-24828 in the wild and no public exploit code.

Other vulnerabilities in theonedev onedev

• CVE-2021-21242 Pre-Auth Unsafe Deserialization on AttachmentUploadServet Critical 10.0
• CVE-2021-21243 Pre-Auth Unsafe Deserialization on KubernetesResource Critical 10.0
• CVE-2021-21244 Pre-Auth SSTI via Bean validation message tampering Critical 10.0
• CVE-2021-21245 Pre-Auth Arbitrary File Upload Critical 10.0
• CVE-2022-39206 CI/CD Docker Escape in OneDev Critical 9.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jf5c-9r77-3j5j.