PT-2021-14352

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3 Description: OneDev is an all-in-one devops platform. In OneDev, there is a critical issue that can lead to pre-auth remote code execution. The AttachmentUploadServlet deserializes untrusted data from the...

PT-2021-14357

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3 Description: OneDev is an all-in-one devops platform. The application's BasePage registers an AJAX event listener AbstractPostAjaxBehavior in all pages other than the login page. This listener decodes and...

PT-2021-14355

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3 Description: OneDev is an all-in-one devops platform. In OneDev, the AttachmentUploadServlet saves user-controlled data request.getInputStream to a user-specified location request.getHeader"File-Name". This issu...

PT-2021-14359

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3 Description: The issue involves YAML parsing and can lead to post-auth remote code execution. OneDev uses SnakeYaml, which allows the instantiation of arbitrary classes by default. This can be leveraged to run...

PT-2021-14353

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3 Description: OneDev is an all-in-one devops platform. In OneDev, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any...

PT-2021-14360

Name of the Vulnerable Software and Affected Versions: OneDev versions prior to 4.0.3 Description: OneDev is an all-in-one devops platform. In OneDev, there is a critical issue that may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by...

CVE-2021-21245: Unrestricted Upload of File with Dangerous Type

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, AttachmentUploadServlet also saves user controlled data request.getInputStream to a user specified location request.getHeader"File-Name". This issue may lead to arbitrary file upload which can be used to upload a WebShell to...

CVE-2021-21246: Missing Authorization

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the /users/id endpoint there are no security checks enforced so it is possible to retrieve...

CVE-2021-21247: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the application's BasePage registers an AJAX event listener AbstractPostAjaxBehavior in all pages other than the login page. This listener decodes and deserializes the data query parameter. We can access this listener by...

CVE-2021-21249: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default when not using SafeConstructor allows the...

CVE-2021-21248: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job paramete...

CVE-2021-21250: Insertion of Sensitive Information into Externally-Accessible File or Directory

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which may lead to arbitrary file read. When BuildSpec is provided in XML format, the spec is processed by XmlBuildSpecMigrator.migratebuildSpecString; which processes the XML document withou...

CVE-2021-21251: Improper Limitation of a Pathname to a Restricted Directory

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3 there is a critical "zip slip" vulnerability. This issue may lead to arbitrary file write. The KubernetesResource REST endpoint untars user controlled data from the request body using TarUtils. TarUtils is a custom library...

CVE-2021-21242: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the Attachment-Support header. This Servlet does not enforce any authentication or...

CVE-2021-21243: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issue may lead to pre-auth RCE. This issue...

CVE-2021-21244: Improper Neutralization of Special Elements in Output Used by a Downstream Component

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, There is a vulnerability that enabled pre-auth server side template injection via Bean validation message tampering. Full details in the reference GHSA. This issue was fixed in 4.0.3 by disabling validation interpolation...