Read the docs
TI-2021-04351 Aliases CVE-2021-21248

Post-Auth Arbitrary Code execution via Groovy script injection

Priority MEDIUM 44CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability involving the build endpoint parameters. InputSpec is used to define parameters of a Build spec. It does so by using dynamically generated Groovy classes. A user able to control job parameters can run arbitrary code on OneDev's server by injecting arbitrary Groovy code. The ultimate result is in the injection of a static constructor that will run arbitrary code. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by escaping special characters such as quote from user input.

Why it matters now

EPSS 0.01469 73rd percentileScored 2026-11-07
Fix Fixed onedev (theonedev): 4.0.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
theonedevonedevbefore 4.0.34.0.3Patch availableCNA
  • onedev Vendortheonedev Affected before 4.0.3 Fixed in 4.0.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:*before 4.0.3Vulnerabletheonedev
  • cpe:2.3:a:onedev_project:onedev:*:*:*:*:*:*:*:* Versions before 4.0.3 Vulnerable ·theonedev

Remediation

  • Fix · CNA onedev (theonedev) Fixed in 4.0.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21248

References

Patch 1

Advisory 1

  • TI-2021-04345 Pre-Auth Unsafe Deserialization on AttachmentUploadServet CVSS 3.1CRITICAL 10.0
  • TI-2022-18585 CI/CD Docker Escape in OneDev CVSS 3.1CRITICAL 9.9
  • TI-2022-18584 Access Control Bypass in Onedev CVSS 3.1CRITICAL 9.8
  • TI-2021-04346 Pre-Auth Unsafe Deserialization on KubernetesResource CVSS 3.1CRITICAL 10.0
  • TI-2022-18587 Git Repository Disclosure in Onedev CVSS 3.1HIGH 7.5
  • TI-2021-04349 Pre-Auth Access token leak CVSS 3.1HIGH 8.6
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences