CVE-2021-21243

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issue may lead to pre-auth RCE. This issue was fixed in 4.0.3 by not using deserialization at KubernetesResource side.

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issue may lead to pre-auth RCE. This issue was fixed in 4.0.3 by not using deserialization at KubernetesResource side.

OneDev es una plataforma devops todo en uno. En OneDev versiones anteriores a 4.0.3, un endpoint REST de Kubernetes expone dos métodos que deserializan datos no confiables desde el cuerpo de la petición. Estos endpoints no aplican ninguna comprobación de autenticación o autorización. Este problema puede conllevar a una RCE previa a la autenticación. Este problema se corrigió en la versión 4.0.3 al no usar la deserialización en el lado de KubernetesResource