// For flags

CVE-2021-21247

Post-Auth Unsafe Deserialization on BasePage (AJAX)

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener (`AbstractPostAjaxBehavior`) in all pages other than the login page. This listener decodes and deserializes the `data` query parameter. We can access this listener by submitting a POST request to any page. This issue may lead to `post-auth RCE` This endpoint is subject to authentication and, therefore, requires a valid user to carry on the attack. This issue was addressed in 4.0.3 by encrypting serialization payload with secrets only known to server.

OneDev es una plataforma devops todo en uno. En OneDev versiones anteriores a 4.0.3, la BasePage de la aplicación registra un detector de eventos AJAX ("AbstractPostAjaxBehavior") en todas las páginas excepto en la página de inicio de sesión. Este oyente decodifica y deserializa el parámetro de consulta "data". Podemos acceder a este oyente mediante el envío de una petición POST a cualquier página. Este problema puede conllevar a una "post-auth RCE". Este endpoint está sujeto a autenticación y, por lo tanto, requiere un usuario válido para llevar a cabo el ataque. Este problema fue abordado en la versión 4.0.3 al descifrar una carga útil de serialización con secretos que solo conoce el servidor

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-12-22 CVE Reserved
  • 2021-01-15 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  • CWE-502: Deserialization of Untrusted Data
CAPEC
References (1)
URL Tag Source
https://github.com/theonedev/onedev/security/advisories/GHSA-6pxf-75cf-vwjp Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Onedev Project
Search vendor "Onedev Project"
 Onedev
Search vendor "Onedev Project" for product "Onedev"
 < 4.0.3
Search vendor "Onedev Project" for product "Onedev" and version " < 4.0.3"
-
Affected