CVE-2021-21248

moderate-risk
Published 2021-01-15

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job parameters can run arbitrary code on OneDev's server by injecting arbitrary Groovy code. The ultimate result is in the injection of a static constructor that will run arbitrary code. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by escaping special characters such as quote from user input.

Do I need to act?

-
0.35% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.6/10 Critical
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Onedev Project

References (4)

Patch https://github.com/theonedev/onedev/commit/39d95ab8122c5d9ed18e69dc024870cae08d2...
Third Party Advisory https://github.com/theonedev/onedev/security/advisories/GHSA-gwp4-5498-hv5f
Patch https://github.com/theonedev/onedev/commit/39d95ab8122c5d9ed18e69dc024870cae08d2...
Third Party Advisory https://github.com/theonedev/onedev/security/advisories/GHSA-gwp4-5498-hv5f
38
/ 100
moderate-risk
Severity 32/34 · Critical
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal