PT-2021-14359 · Snakeyaml+1 · Snakeyaml+1

Pwntester · Published 2021-01-15 · Updated 2022-04-26 · CVE-2021-21249

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3

Description: The issue involves YAML parsing and can lead to post-auth remote code execution. OneDev uses SnakeYaml, which allows the instantiation of arbitrary classes by default. This can be leveraged to run arbitrary code by instantiating classes such as javax.script.ScriptEngineManager and using URLClassLoader to load the script engine provider, resulting in the instantiation of a user-controlled class.

Recommendations: For versions prior to 4.0.3, update to version 4.0.3 or later, which only allows certain known classes to be deserialized. As a temporary workaround, consider disabling the use of SnakeYaml or restricting the instantiation of arbitrary classes until a patch is available.

Fix

Deserialization of Untrusted Data

Special Elements Injection

Weakness Enumeration

CWE-502

CWE-74

Related Identifiers

CVE-2021-21249

GHSA-7XHQ-M2Q9-6HPM

Affected Products

Onedev

Snakeyaml

References · 5

• https://github.com/theonedev/onedev/commit/d6fc4212b1ac1e9bbe3ce444e95f9af1e3ab8b66 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21249 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21249 · Vendor Advisory
• https://github.com/theonedev/onedev/security/advisories/GHSA-7xhq-m2q9-6hpm · Note
• https://t.me/cvenotify/8621 · Telegram Post