One Article Review
| Source |  CVE Liste |
|---|---|
| Identifiant | 2200499 |
| Date de publication | 2021-01-15 21:15:13 (vue: 2021-01-16 00:05:14) |
| Titre | CVE-2021-21249 |
| Texte | OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default (when not using `SafeConstructor`) allows the instantiation of arbitrary classes. We can leverage that to run arbitrary code by instantiating classes such as `javax.script.ScriptEngineManager` and using `URLClassLoader` to load the script engine provider, resulting in the instantiation of a user controlled class. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by only allowing certain known classes to be deserialized |
| Notes | |
| Envoyé | Oui |
| Condensat | 2021 21249 `javax `safeconstructor` `urlclassloader` addressed all allowing allows arbitrary auth before can certain class classes code controlled cve default deserialized devops engine example execution files full ghsa instantiating instantiation involving issue known lead leverage load not one onedev only order parse parsing platform post process provider refer referenced remote resulting run script scriptenginemanager` snakeyaml such user uses using version when which yaml |
| Tags | Guideline |
| Stories | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.