// For flags

CVE-2021-21250

Post-Auth External Entity Expansion (XXE)

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migrate(buildSpecString); which processes the XML document without preventing the expansion of external entities. These entities can be configured to read arbitrary files from the file system and dump their contents in the final XML document to be migrated. If the files are dumped in properties included in the YAML file, it will be possible for an attacker to read them. If not, it is possible for an attacker to exfiltrate the contents of these files Out Of Band. This issue was addressed in 4.0.3 by ignoring ENTITY instructions in xml file.

OneDev es una plataforma devops todo en uno. En OneDev versiones anteriores a 4.0.3, Se presenta una vulnerabilidad crítica que puede conllevar a una lectura arbitraria de archivos. Cuando BuildSpec se proporciona en formato XML, XmlBuildSpecMigrator.migrate (buildSpecString) procesa la especificación; que procesa el documento XML sin evitar la expansión de entidades externas. Estas entidades se pueden configurar para leer archivos arbitrarios del sistema de archivos y volcar su contenido en el documento XML final que se migrará. Si los archivos se vuelcan en propiedades incluidas en el archivo YAML, un atacante podrá leerlos. Si no es así, es posible a un atacante exfiltre el contenido de estos archivos Fuera de la Banda. Este problema es corregido en versión 4.0.3 ignorando las instrucciones de ENTITY en el archivo xml

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-12-22 CVE Reserved
  • 2021-01-15 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Onedev Project
Search vendor "Onedev Project"
 Onedev
Search vendor "Onedev Project" for product "Onedev"
 < 4.0.3
Search vendor "Onedev Project" for product "Onedev" and version " < 4.0.3"
-
Affected