CVE-2021-21246 Pre-Auth Access token leak
Attackers can retrieve arbitrary user access tokens via an unprotected REST endpoint, enabling impersonation and unauthorized access to projects.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21246?
CVE-2021-21246 is a high-severity missing authorization vulnerability in theonedev onedev, published on 15 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/{id}` endpoint there are no security checks enforced so it is possible to retrieve arbitrary user details including their Access Tokens! These access tokens can be used to access the API or clone code in the build spec via the HTTP(S) protocol. It has permissions to all projects accessible by the user account. This issue may lead to `Sensitive data leak` and leak the Access Token which can be used to impersonate the administrator or any other users. This issue was addressed in 4.0.3 by removing user info from restful api.
Weakness: CWE-862
Which versions are affected by CVE-2021-21246?
It affects 1 product.
Products include Onedev Project Onedev.
How do I fix CVE-2021-21246?
No fix has been published for CVE-2021-21246 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-21246 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-21246 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in theonedev onedev
Sources
Also known as GHSA-66v7-gg85-f4gx.