OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job parameters can run arbitrary code on OneDev's server by injecting arbitrary Groovy code. The ultimate result is in the injection of a static constructor that will run arbitrary code. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by escaping special characters such as quote from user input.
References
Link | Resource |
---|---|
https://github.com/theonedev/onedev/commit/39d95ab8122c5d9ed18e69dc024870cae08d2d60 | Patch Third Party Advisory |
https://github.com/theonedev/onedev/security/advisories/GHSA-gwp4-5498-hv5f | Third Party Advisory |
Configurations
History
19 Oct 2022, 13:15
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-94 |
21 Jan 2021, 14:28
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://github.com/theonedev/onedev/commit/39d95ab8122c5d9ed18e69dc024870cae08d2d60 - Patch, Third Party Advisory | |
References | (CONFIRM) https://github.com/theonedev/onedev/security/advisories/GHSA-gwp4-5498-hv5f - Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : 6.5
v3 : 8.8 |
CPE | cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:* |
15 Jan 2021, 21:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2021-01-15 21:15
Updated : 2023-12-10 13:41
NVD link : CVE-2021-21248
Mitre link : CVE-2021-21248
CVE.ORG link : CVE-2021-21248
JSON object : View
Products Affected
onedev_project
- onedev