CVE-2021-21249
HIGH EPSS 85.4%
Published Jan 15, 20215y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
Published Jan 15, 2021 5y ago
Last Modified Jun 17, 2026 2w ago
Description
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default (when not using `SafeConstructor`) allows the instantiation of arbitrary classes. We can leverage that to run arbitrary code by instantiating classes such as `javax.script.ScriptEngineManager` and using `URLClassLoader` to load the script engine provider, resulting in the instantiation of a user controlled class. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by only allowing certain known classes to be deserialized
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
85.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 2
CWE-502 Deserialization of Untrusted Data Validation
CWE-74
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| onedev_project | onedev | * | <4.0.3 |
References 2
- github.com https://github.com/theonedev/onedev/commit/d6fc4212b1ac1e9bbe3ce444e95f9af1e3ab8b66
- github.com https://github.com/theonedev/onedev/security/advisories/GHSA-7xhq-m2q9-6hpm
Remediation
- github.com https://github.com/theonedev/onedev/commit/d6fc4212b1ac1e9bbe3ce444e95f9af1e3ab8b66