CVE-2021-21243
📋 TL;DR
This vulnerability in OneDev allows unauthenticated remote code execution via insecure deserialization in Kubernetes REST endpoints. Attackers can exploit this to execute arbitrary code on affected systems without any authentication. All OneDev instances before version 4.0.3 are vulnerable.
💻 Affected Systems
- OneDev
📦 What is this software?
Onedev by Onedev Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the OneDev server, potentially leading to data theft, lateral movement, and persistent backdoors.
Likely Case
Remote code execution allowing attackers to deploy malware, exfiltrate sensitive data, or disrupt DevOps operations.
If Mitigated
No impact if patched to version 4.0.3 or later, or if network access controls prevent access to vulnerable endpoints.
🎯 Exploit Status
The vulnerability is straightforward to exploit due to the lack of authentication and the use of insecure deserialization.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.3
Vendor Advisory: https://github.com/theonedev/onedev/security/advisories/GHSA-9mmq-fm8c-q4fv
Restart Required: Yes
Instructions:
1. Backup your OneDev instance and data. 2. Stop the OneDev service. 3. Upgrade to version 4.0.3 or later using the official upgrade instructions. 4. Restart the OneDev service. 5. Verify the upgrade was successful.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict network access to the OneDev instance using firewall rules to only allow trusted IP addresses.
iptables -A INPUT -p tcp --dport [onedev-port] -s [trusted-ip] -j ACCEPT
iptables -A INPUT -p tcp --dport [onedev-port] -j DROP
Reverse Proxy Authentication
allPlace OneDev behind a reverse proxy that enforces authentication before requests reach the vulnerable endpoints.
🧯 If You Can't Patch
- Isolate the OneDev instance in a separate network segment with strict access controls.
- Implement network monitoring and intrusion detection specifically for suspicious requests to Kubernetes REST endpoints.
🔍 How to Verify
Check if Vulnerable:
Check the OneDev version via the web interface or by examining the installation directory. If version is below 4.0.3, the system is vulnerable.Check Version:
Check the web interface at /admin/about or examine the server logs for version information.Verify Fix Applied:
After upgrading, verify the version is 4.0.3 or higher and test that the Kubernetes REST endpoints no longer accept deserialization requests.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to Kubernetes REST endpoints
- Deserialization errors in logs
- Unexpected process execution from OneDev
Network Indicators:
- POST requests to /~api/kubernetes/* endpoints with serialized data
- Unusual outbound connections from OneDev server
SIEM Query:
source="onedev" AND (uri_path="/~api/kubernetes/*" OR message="*deserialization*")🔗 References
- https://github.com/theonedev/onedev/commit/9637fc8fa461c5777282a0021c3deb1e7a48f137
- https://github.com/theonedev/onedev/security/advisories/GHSA-9mmq-fm8c-q4fv
- https://github.com/theonedev/onedev/commit/9637fc8fa461c5777282a0021c3deb1e7a48f137
- https://github.com/theonedev/onedev/security/advisories/GHSA-9mmq-fm8c-q4fv
