CVE-2021-21250

moderate-risk
Published 2021-01-15

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migrate(buildSpecString); which processes the XML document without preventing the expansion of external entities. These entities can be configured to read arbitrary files from the file system and dump their contents in the final XML document to be migrated. If the files are dumped in properties included in the YAML file, it will be possible for an attacker to read them. If not, it is possible for an attacker to exfiltrate the contents of these files Out Of Band. This issue was addressed in 4.0.3 by ignoring ENTITY instructions in xml file.

Do I need to act?

-
0.29% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.7/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Onedev Project

References (4)

Patch https://github.com/theonedev/onedev/commit/9196fd795e87dab069b4260a3590a0ea886e7...
Third Party Advisory https://github.com/theonedev/onedev/security/advisories/GHSA-9pph-8gfc-6w2r
Patch https://github.com/theonedev/onedev/commit/9196fd795e87dab069b4260a3590a0ea886e7...
Third Party Advisory https://github.com/theonedev/onedev/security/advisories/GHSA-9pph-8gfc-6w2r
33
/ 100
moderate-risk
Severity 27/34 · High
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal