CVE-2021-21249

Katalog CVE

CVSS 8.8 · High EPSS 3,1%

Kerentanan Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') pada onedev project onedev. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default (when not using `SafeConstructor`) allows the instantiation of arbitrary classes. We can leverage that to run arbitrary code by instantiating classes such as `javax.script.ScriptEngineManager` and using `URLClassLoader` to load the script engine provider, resulting in the instantiation of a user controlled class. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by only allowing certain known classes to be deserialized

Rincian

Terbit di NVD

15 Januari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

3,1% peluang dieksploitasi; lebih tinggi dari 87,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/theonedev/onedev/commit/d6fc4212b1ac1e9bbe3ce444e95f9af1e3ab8b66 patch · advisory pihak ketiga
• https://github.com/theonedev/onedev/security/advisories/GHSA-7xhq-m2q9-6hpm advisory pihak ketiga