PT-2021-14360 · Onedev · Onedev

Pwntester · Published 2021-01-15 · Updated 2021-01-21 · CVE-2021-21250

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3

Description: OneDev is an all-in-one devops platform. In OneDev, there is a critical issue that may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migrate(buildSpecString), which processes the XML document without preventing the expansion of external entities. These entities can be configured to read arbitrary files from the file system and dump their contents in the final XML document to be migrated. If the files are dumped in properties included in the YAML file, it will be possible for an attacker to read them. If not, it is possible for an attacker to exfiltrate the contents of these files Out Of Band.

Recommendations: For versions prior to 4.0.3, update to version 4.0.3 or later, which addresses the issue by ignoring ENTITY instructions in xml files. As a temporary workaround, consider disabling the XmlBuildSpecMigrator.migrate(buildSpecString) function until a patch is available. Restrict access to the buildSpecString parameter to minimize the risk of exploitation. Avoid using the buildSpecString parameter in the affected XML endpoint until the issue is resolved.

Fix

Weakness Enumeration

CWE-538

Related Identifiers

CVE-2021-21250

GHSA-9PPH-8GFC-6W2R

Affected Products

Onedev

References · 6

• https://github.com/theonedev/onedev/commit/9196fd795e87dab069b4260a3590a0ea886e770f · Patch
• https://osv.dev/vulnerability/CVE-2021-21250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21250 · Security Note
• https://github.com/theonedev/onedev/security/advisories/GHSA-9pph-8gfc-6w2r · Note
• https://t.me/cibsecurity/22226 · Telegram Post
• https://t.me/cvenotify/8617 · Telegram Post