PT-2021-14352 · Onedev · Onedev

Pwntester · Published 2021-01-15 · Updated 2021-01-21 · CVE-2021-21242

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3

Description: OneDev is an all-in-one devops platform. In OneDev, there is a critical issue that can lead to pre-auth remote code execution. The AttachmentUploadServlet deserializes untrusted data from the Attachment-Support header and does not enforce any authentication or authorization checks, which may lead to pre-auth remote code execution.

Recommendations: For versions prior to 4.0.3, update to version 4.0.3 or later, which removes the AttachmentUploadServlet and no longer uses deserialization, thus fixing the issue.

Fix

Deserialization of Untrusted Data

Special Elements Injection

Weakness Enumeration

CWE-502

CWE-74

Related Identifiers

CVE-2021-21242

GHSA-5Q3Q-F373-2JV8

Affected Products

Onedev

References · 6

• https://github.com/theonedev/onedev/commit/f864053176c08f59ef2d97fea192ceca46a4d9be · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21242 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21242 · Vendor Advisory
• https://github.com/theonedev/onedev/security/advisories/GHSA-5q3q-f373-2jv8 · Note
• https://t.me/cibsecurity/22233 · Telegram Post
• https://t.me/cvenotify/8615 · Telegram Post