CVE-2021-21243 (XML, published 2021-01-15T20:15Z)
Description: value: OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issue may lead to pre-auth RCE. This issue was fixed in 4.0.3 by not using deserialization at KubernetesResource side.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/theonedev/onedev
Files changed:
pom.xml
server-core/pom.xml
server-plugin/pom.xml
server-plugin/server-plugin-archetype/pom.xml
server-plugin/server-plugin-authenticator-ldap/pom.xml
server-plugin/server-plugin-buildspec-gradle/pom.xml
server-plugin/server-plugin-buildspec-maven/pom.xml
server-plugin/server-plugin-buildspec-node/pom.xml
server-plugin/server-plugin-executor-docker/pom.xml
server-plugin/server-plugin-executor-kubernetes/pom.xml
server-plugin/server-plugin-executor-kubernetes/src/main/java/io/onedev/server/plugin/executor/kubernetes/KubernetesResource.java
server-plugin/server-plugin-report-html/pom.xml
server-plugin/server-plugin-report-markdown/pom.xml
server-plugin/server-plugin-sso-openid/pom.xml
server-product/pom.xml
Commit message: Do not deserialize data from job nodes in Kubernetes resource to avoid
security vulnerability

Vulnerable code:
	<version>4.0.0</version>
		<k8shelper.version>1.0.20</k8shelper.version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
    public byte[] allocateJobCaches(byte[] cacheAllocationRequestBytes) {
		CacheAllocationRequest allocationRequest = (CacheAllocationRequest) SerializationUtils
				.deserialize(cacheAllocationRequestBytes);
				getJobToken(), allocationRequest.getCurrentTime(), allocationRequest.getInstances()));
	public void reportJobCaches(byte[] cacheInstanceBytes) {
		@SuppressWarnings("unchecked")
		Collection<CacheInstance> cacheInstances = (Collection<CacheInstance>) SerializationUtils
				.deserialize(cacheInstanceBytes);
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>
		<version>4.0.0</version>

Fixed code:
	<version>4.0.1</version>
		<k8shelper.version>1.0.21</k8shelper.version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
import com.google.common.base.Splitter;
    public byte[] allocateJobCaches(String cacheAllocationRequestString) {
		CacheAllocationRequest cacheAllocationRequest = CacheAllocationRequest.fromString(cacheAllocationRequestString);
				getJobToken(), cacheAllocationRequest.getCurrentTime(), cacheAllocationRequest.getInstances()));
	public void reportJobCaches(String cacheInstancesString) {
		Collection<CacheInstance> cacheInstances = new ArrayList<>();
		for (String field: Splitter.on(';').omitEmptyStrings().split(cacheInstancesString))
			cacheInstances.add(CacheInstance.fromString(field));
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>
		<version>4.0.1</version>