CVE-2021-21245 Pre-Auth Arbitrary File Upload
An attacker can upload arbitrary files, potentially including webshells, to the OneDev server via the attachment upload servlet.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21245?
CVE-2021-21245 is a critical vulnerability in theonedev onedev, published on 15 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data (`request.getInputStream()`) to a user specified location (`request.getHeader("File-Name")`). This issue may lead to arbitrary file upload which can be used to upload a WebShell to OneDev server. This issue is addressed in 4.0.3 by only allowing uploaded file to be in attachments folder. The webshell issue is not possible as OneDev never executes files in attachments folder.
Weakness: CWE-434
Which versions are affected by CVE-2021-21245?
It affects 1 product.
Products include Onedev Project Onedev.
How do I fix CVE-2021-21245?
No fix has been published for CVE-2021-21245 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21245 being exploited?
There is no known exploitation of CVE-2021-21245 in the wild and no public exploit code.
Other vulnerabilities in theonedev onedev
- CVE-2021-21242 Pre-Auth Unsafe Deserialization on AttachmentUploadServet
- CVE-2021-21243 Pre-Auth Unsafe Deserialization on KubernetesResource
- CVE-2021-21244 Pre-Auth SSTI via Bean validation message tampering
- CVE-2022-39206 CI/CD Docker Escape in OneDev
- CVE-2021-21247 Post-Auth Unsafe Deserialization on BasePage (AJAX)
Sources
Also known as GHSA-62m2-38q5-96w9.