CVE-2021-21242
📋 TL;DR
CVE-2021-21242 is a critical pre-authentication remote code execution vulnerability in OneDev devops platform. Attackers can exploit insecure deserialization in AttachmentUploadServlet to execute arbitrary code without authentication. All OneDev instances before version 4.0.3 are affected.
💻 Affected Systems
- OneDev
📦 What is this software?
Onedev by Onedev Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal sensitive data, deploy ransomware, or pivot to other systems.
Likely Case
Remote code execution leading to data theft, service disruption, and installation of backdoors or cryptocurrency miners.
If Mitigated
Limited impact if proper network segmentation and monitoring are in place, but still significant due to pre-auth nature.
🎯 Exploit Status
Exploitation is straightforward due to pre-auth nature and public proof-of-concept code available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.3
Vendor Advisory: https://github.com/theonedev/onedev/security/advisories/GHSA-5q3q-f373-2jv8
Restart Required: Yes
Instructions:
1. Backup your OneDev instance. 2. Upgrade to version 4.0.3 or later. 3. Restart the OneDev service. 4. Verify the upgrade was successful.
🔧 Temporary Workarounds
Network Access Control
allRestrict network access to OneDev instances using firewalls or network security groups
Reverse Proxy Filtering
linuxConfigure reverse proxy to block requests containing 'Attachment-Support' header
# Example nginx configuration
location /onedev/ {
proxy_set_header Attachment-Support "";
proxy_pass http://localhost:6610;
}
🧯 If You Can't Patch
- Isolate OneDev instances from internet and restrict internal network access
- Implement strict network monitoring for suspicious requests to AttachmentUploadServlet
🔍 How to Verify
Check if Vulnerable:
Check OneDev version via web interface or by examining installation directory. Versions below 4.0.3 are vulnerable.Check Version:
# Check version via API or web interface
curl -s http://your-onedev-server/api/versionVerify Fix Applied:
Verify version is 4.0.3 or higher and confirm AttachmentUploadServlet is no longer present in the application.📡 Detection & Monitoring
Log Indicators:
- Requests to /attachment-upload endpoint
- Java deserialization errors in logs
- Suspicious process creation from OneDev service
Network Indicators:
- HTTP requests with 'Attachment-Support' header containing serialized data
- Unusual outbound connections from OneDev server
SIEM Query:
source="onedev.logs" AND (uri_path="/attachment-upload" OR message="*AttachmentUploadServlet*" OR message="*deserialization*")🔗 References
- https://github.com/theonedev/onedev/commit/f864053176c08f59ef2d97fea192ceca46a4d9be
- https://github.com/theonedev/onedev/security/advisories/GHSA-5q3q-f373-2jv8
- https://github.com/theonedev/onedev/commit/f864053176c08f59ef2d97fea192ceca46a4d9be
- https://github.com/theonedev/onedev/security/advisories/GHSA-5q3q-f373-2jv8
