CVE-2021-21244

Pre-Auth SSTI via Bean validation message tampering

Severity Score

9.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.

OneDev es una plataforma devops todo en uno. En OneDev versiones anteriores a 4.0.3. Se presenta una vulnerabilidad que habilita una inyección de plantilla del lado del servidor previa a la autenticación por medio de la manipulación del mensaje de comprobación de Bean. Detalles completos en la referencia GHSA. Este problema se corrigió en la versión 4.0.3 al deshabilitar la interpolación de comprobación por completo

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-12-22 CVE Reserved
2021-01-15 CVE Published
2023-08-22 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')

CAPEC

References (2)

URL	Tag	Source
https://github.com/theonedev/onedev/security/advisories/GHSA-vm26-xg39-cfj4	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://github.com/theonedev/onedev/commit/4f5dc6fb9e50f2c41c4929b0d8c5824b2cca3d65	2022-10-19

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Onedev Project Search vendor "Onedev Project"		Onedev Search vendor "Onedev Project" for product "Onedev"				< 4.0.3 Search vendor "Onedev Project" for product "Onedev" and version " < 4.0.3"		-		Affected