CVE-2021-21243: Deserialization of Untrusted Data (CWE-502)
value: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issue may lead to pre-auth RCE. This issue was fixed in 4.0.3 by not using deserialization at KubernetesResource side.
CWE description: The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CVSS v3 base score: 9.8
Published: 2021-01-15T20:15Z
Repository: https://github.com/theonedev/onedev
Language: XML
Files changed: pom.xml, server-core/pom.xml, server-plugin/pom.xml, server-plugin/server-plugin-archetype/pom.xml, server-plugin/server-plugin-authenticator-ldap/pom.xml, server-plugin/server-plugin-buildspec-gradle/pom.xml, server-plugin/server-plugin-buildspec-maven/pom.xml, server-plugin/server-plugin-buildspec-node/pom.xml, server-plugin/server-plugin-executor-docker/pom.xml, server-plugin/server-plugin-executor-kubernetes/pom.xml, server-plugin/server-plugin-executor-kubernetes/src/main/java/io/onedev/server/plugin/executor/kubernetes/KubernetesResource.java, server-plugin/server-plugin-report-html/pom.xml, server-plugin/server-plugin-report-markdown/pom.xml, server-plugin/server-plugin-sso-openid/pom.xml, server-product/pom.xml
Commit date: 2020-11-19 12:09:04 +0800
Commit message: Do not deserialize data from job nodes in Kubernetes resource to avoid
security vulnerability
Diff: diff --git a/pom.xml b/pom.xml
index 74c3a1ef06..78dd663ae5 100644
--- a/pom.xml
+++ b/pom.xml
@@ -7,11 +7,11 @@
 		<groupId>io.onedev</groupId>
 		<artifactId>parent</artifactId>
 		<version>1.0.5</version>
 	</parent>
 	<artifactId>server</artifactId>
-	<version>4.0.0</version>
+	<version>4.0.1</version>
 	<packaging>pom</packaging>
 	<build>
 		<finalName>${project.groupId}.${project.artifactId}-${project.version}</finalName>
 		<pluginManagement>
 			<plugins>
@@ -572,11 +572,11 @@
 			</snapshots>
 		</repository>
 	</repositories>
 	<properties>
 		<commons.version>1.1.21</commons.version>
-		<k8shelper.version>1.0.20</k8shelper.version>
+		<k8shelper.version>1.0.21</k8shelper.version>
 		<slf4j.version>1.7.5</slf4j.version>
 		<logback.version>1.0.11</logback.version>
 		<antlr.version>4.7.2</antlr.version>
 		<jetty.version>9.4.24.v20191120</jetty.version>
 		<wicket.version>7.17.0</wicket.version>
diff --git a/server-core/pom.xml b/server-core/pom.xml
index d2658ebcf3..d6afca5912 100644
--- a/server-core/pom.xml
+++ b/server-core/pom.xml
@@ -5,11 +5,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-core</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<build>
 		<plugins>
 			<plugin>
 				<groupId>org.antlr</groupId>
diff --git a/server-plugin/pom.xml b/server-plugin/pom.xml
index fea6340305..4a905e16ad 100644
--- a/server-plugin/pom.xml
+++ b/server-plugin/pom.xml
@@ -4,11 +4,11 @@
 	<artifactId>server-plugin</artifactId>
 	<packaging>pom</packaging>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-core</artifactId>
diff --git a/server-plugin/server-plugin-archetype/pom.xml b/server-plugin/server-plugin-archetype/pom.xml
index 271b0e4a6f..2c2042024a 100644
--- a/server-plugin/server-plugin-archetype/pom.xml
+++ b/server-plugin/server-plugin-archetype/pom.xml
@@ -4,11 +4,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-archetype</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<build>
 		<resources>
 		  <resource>
 			<directory>src/main/resources</directory>
diff --git a/server-plugin/server-plugin-authenticator-ldap/pom.xml b/server-plugin/server-plugin-authenticator-ldap/pom.xml
index 76cc188fde..4ccb1c1310 100644
--- a/server-plugin/server-plugin-authenticator-ldap/pom.xml
+++ b/server-plugin/server-plugin-authenticator-ldap/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-authenticator-ldap</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.authenticator.ldap.LdapModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-buildspec-gradle/pom.xml b/server-plugin/server-plugin-buildspec-gradle/pom.xml
index 5d5e5372da..01063b2c0d 100644
--- a/server-plugin/server-plugin-buildspec-gradle/pom.xml
+++ b/server-plugin/server-plugin-buildspec-gradle/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-buildspec-gradle</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-plugin-report-html</artifactId>
diff --git a/server-plugin/server-plugin-buildspec-maven/pom.xml b/server-plugin/server-plugin-buildspec-maven/pom.xml
index 41083dc061..e907cf6b4c 100644
--- a/server-plugin/server-plugin-buildspec-maven/pom.xml
+++ b/server-plugin/server-plugin-buildspec-maven/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-buildspec-maven</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.buildspec.maven.MavenModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-buildspec-node/pom.xml b/server-plugin/server-plugin-buildspec-node/pom.xml
index 734f4fb954..43e6921257 100644
--- a/server-plugin/server-plugin-buildspec-node/pom.xml
+++ b/server-plugin/server-plugin-buildspec-node/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-buildspec-node</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.buildspec.node.NodePluginModule</moduleClass>
 	</properties>
 
diff --git a/server-plugin/server-plugin-executor-docker/pom.xml b/server-plugin/server-plugin-executor-docker/pom.xml
index 131cdc320c..3e9c721529 100644
--- a/server-plugin/server-plugin-executor-docker/pom.xml
+++ b/server-plugin/server-plugin-executor-docker/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-executor-docker</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.docker.DockerModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-executor-kubernetes/pom.xml b/server-plugin/server-plugin-executor-kubernetes/pom.xml
index 1ad33b7b4a..de0de3d470 100644
--- a/server-plugin/server-plugin-executor-kubernetes/pom.xml
+++ b/server-plugin/server-plugin-executor-kubernetes/pom.xml
@@ -4,11 +4,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-executor-kubernetes</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.executor.kubernetes.KubernetesModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-executor-kubernetes/src/main/java/io/onedev/server/plugin/executor/kubernetes/KubernetesResource.java b/server-plugin/server-plugin-executor-kubernetes/src/main/java/io/onedev/server/plugin/executor/kubernetes/KubernetesResource.java
index c1271a2024..840c4460a7 100644
--- a/server-plugin/server-plugin-executor-kubernetes/src/main/java/io/onedev/server/plugin/executor/kubernetes/KubernetesResource.java
+++ b/server-plugin/server-plugin-executor-kubernetes/src/main/java/io/onedev/server/plugin/executor/kubernetes/KubernetesResource.java
@@ -23,10 +23,11 @@ import javax.ws.rs.core.MediaType;
 import javax.ws.rs.core.Response;
 import javax.ws.rs.core.StreamingOutput;
 
 import org.apache.commons.lang.SerializationUtils;
 
+import com.google.common.base.Splitter;
 import com.google.common.collect.Lists;
 
 import io.onedev.commons.utils.TarUtils;
 import io.onedev.k8shelper.CacheAllocationRequest;
 import io.onedev.k8shelper.CacheInstance;
@@ -71,24 +72,23 @@ public class KubernetesResource {
 	
 	@Path("/allocate-job-caches")
 	@Consumes(MediaType.APPLICATION_OCTET_STREAM)
 	@Produces(MediaType.APPLICATION_OCTET_STREAM)
     @POST
-    public byte[] allocateJobCaches(byte[] cacheAllocationRequestBytes) {
-		CacheAllocationRequest allocationRequest = (CacheAllocationRequest) SerializationUtils
-				.deserialize(cacheAllocationRequestBytes);
+    public byte[] allocateJobCaches(String cacheAllocationRequestString) {
+		CacheAllocationRequest cacheAllocationRequest = CacheAllocationRequest.fromString(cacheAllocationRequestString);
 		return SerializationUtils.serialize((Serializable) jobManager.allocateJobCaches(
-				getJobToken(), allocationRequest.getCurrentTime(), allocationRequest.getInstances()));
+				getJobToken(), cacheAllocationRequest.getCurrentTime(), cacheAllocationRequest.getInstances()));
     }
 	
 	@Path("/report-job-caches")
 	@Consumes(MediaType.APPLICATION_OCTET_STREAM)
 	@POST
-	public void reportJobCaches(byte[] cacheInstanceBytes) {
-		@SuppressWarnings("unchecked")
-		Collection<CacheInstance> cacheInstances = (Collection<CacheInstance>) SerializationUtils
-				.deserialize(cacheInstanceBytes);
+	public void reportJobCaches(String cacheInstancesString) {
+		Collection<CacheInstance> cacheInstances = new ArrayList<>();
+		for (String field: Splitter.on(';').omitEmptyStrings().split(cacheInstancesString))
+			cacheInstances.add(CacheInstance.fromString(field));
 		jobManager.reportJobCaches(getJobToken(), cacheInstances);
 	}
 	
 	@Path("/download-dependencies")
 	@Produces(MediaType.APPLICATION_OCTET_STREAM)
diff --git a/server-plugin/server-plugin-report-html/pom.xml b/server-plugin/server-plugin-report-html/pom.xml
index 29d04e02c0..c8744f45b9 100644
--- a/server-plugin/server-plugin-report-html/pom.xml
+++ b/server-plugin/server-plugin-report-html/pom.xml
@@ -4,11 +4,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-html</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.report.html.HtmlReportModule</moduleClass>
 	</properties>
 </project>
\ No newline at end of file
diff --git a/server-plugin/server-plugin-report-markdown/pom.xml b/server-plugin/server-plugin-report-markdown/pom.xml
index 786a4e675c..8021bed869 100644
--- a/server-plugin/server-plugin-report-markdown/pom.xml
+++ b/server-plugin/server-plugin-report-markdown/pom.xml
@@ -3,11 +3,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-report-markdown</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<properties>
 		<moduleClass>io.onedev.server.plugin.report.markdown.MarkdownReportModule</moduleClass>
 	</properties>
 </project>
diff --git a/server-plugin/server-plugin-sso-openid/pom.xml b/server-plugin/server-plugin-sso-openid/pom.xml
index 50e567a80f..90a99cacc3 100644
--- a/server-plugin/server-plugin-sso-openid/pom.xml
+++ b/server-plugin/server-plugin-sso-openid/pom.xml
@@ -4,11 +4,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-plugin-sso-openid</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server-plugin</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>com.nimbusds</groupId>
 			<artifactId>oauth2-oidc-sdk</artifactId>
diff --git a/server-product/pom.xml b/server-product/pom.xml
index 88aa453714..f9df4216fa 100644
--- a/server-product/pom.xml
+++ b/server-product/pom.xml
@@ -5,11 +5,11 @@
 	<modelVersion>4.0.0</modelVersion>
 	<artifactId>server-product</artifactId>
 	<parent>
 		<groupId>io.onedev</groupId>
 		<artifactId>server</artifactId>
-		<version>4.0.0</version>
+		<version>4.0.1</version>
 	</parent>
 	<dependencies>
 		<dependency>
 			<groupId>io.onedev</groupId>
 			<artifactId>server-core</artifactId>

Vulnerable code: 	<version>4.0.0</version>
		<k8shelper.version>1.0.20</k8shelper.version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
    public byte[] allocateJobCaches(byte[] cacheAllocationRequestBytes) {
		CacheAllocationRequest allocationRequest = (CacheAllocationRequest) SerializationUtils
				.deserialize(cacheAllocationRequestBytes);
				getJobToken(), allocationRequest.getCurrentTime(), allocationRequest.getInstances()));
	public void reportJobCaches(byte[] cacheInstanceBytes) {
		@SuppressWarnings("unchecked")
		Collection<CacheInstance> cacheInstances = (Collection<CacheInstance>) SerializationUtils
				.deserialize(cacheInstanceBytes);
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
Fixed code: 	<version>4.0.1</version>
		<k8shelper.version>1.0.21</k8shelper.version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
import com.google.common.base.Splitter;
    public byte[] allocateJobCaches(String cacheAllocationRequestString) {
		CacheAllocationRequest cacheAllocationRequest = CacheAllocationRequest.fromString(cacheAllocationRequestString);
				getJobToken(), cacheAllocationRequest.getCurrentTime(), cacheAllocationRequest.getInstances()));
	public void reportJobCaches(String cacheInstancesString) {
		Collection<CacheInstance> cacheInstances = new ArrayList<>();
		for (String field: Splitter.on(';').omitEmptyStrings().split(cacheInstancesString))
			cacheInstances.add(CacheInstance.fromString(field));
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>