CVE-2021-21244 Pre-Auth SSTI via Bean validation message tampering

What is CVE-2021-21244?

CVE-2021-21244 is a critical code injection vulnerability in theonedev onedev, published on 15 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation completely.

Weakness: CWE-94, CWE-74

Which versions are affected by CVE-2021-21244?

It affects 1 product.

Products include Onedev Project Onedev.

How do I fix CVE-2021-21244?

No fix has been published for CVE-2021-21244 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-21244 being exploited?

There is no known exploitation of CVE-2021-21244 in the wild and no public exploit code.

Other vulnerabilities in theonedev onedev

• CVE-2021-21242 Pre-Auth Unsafe Deserialization on AttachmentUploadServet Critical 10.0
• CVE-2021-21243 Pre-Auth Unsafe Deserialization on KubernetesResource Critical 10.0
• CVE-2021-21245 Pre-Auth Arbitrary File Upload Critical 10.0
• CVE-2022-39206 CI/CD Docker Escape in OneDev Critical 9.9
• CVE-2021-21247 Post-Auth Unsafe Deserialization on BasePage (AJAX) Critical 9.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vm26-xg39-cfj4.