PT-2021-14355 · Onedev · Onedev

Pwntester · Published 2021-01-15 · Updated 2021-01-21 · CVE-2021-21245

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3

Description: OneDev is an all-in-one devops platform. In OneDev, the AttachmentUploadServlet saves user-controlled data (request.getInputStream()) to a user-specified location (request.getHeader("File-Name")). This issue may lead to arbitrary file upload, which can be used to upload a WebShell to the OneDev server. However, the webshell issue is not possible as OneDev never executes files in the attachments folder.

Recommendations: For versions prior to 4.0.3, update to version 4.0.3 or later, which only allows uploaded files to be in the attachments folder, addressing the issue.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-21245

GHSA-62M2-38Q5-96W9

Affected Products

Onedev

References · 6

• https://github.com/theonedev/onedev/commit/0c060153fb97c0288a1917efdb17cc426934dacb · Patch
• https://osv.dev/vulnerability/CVE-2021-21245 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21245 · Security Note
• https://github.com/theonedev/onedev/security/advisories/GHSA-62m2-38q5-96w9 · Note
• https://t.me/cvenotify/8616 · Telegram Post
• https://t.me/cibsecurity/22227 · Telegram Post