漏洞标题
后授权不安全的Yaml反序列化
漏洞描述信息
后授权不安全的YAML反序列化
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
漏洞类别
N/A
漏洞标题
Post-Auth Unsafe Yaml deserialization
漏洞描述信息
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is an issue involving YAML parsing which can lead to post-auth remote code execution. In order to parse and process YAML files, OneDev uses SnakeYaml which by default (when not using `SafeConstructor`) allows the instantiation of arbitrary classes. We can leverage that to run arbitrary code by instantiating classes such as `javax.script.ScriptEngineManager` and using `URLClassLoader` to load the script engine provider, resulting in the instantiation of a user controlled class. For a full example refer to the referenced GHSA. This issue was addressed in 4.0.3 by only allowing certain known classes to be deserialized
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
漏洞类别
输出中的特殊元素转义处理不恰当(注入)
漏洞标题
Theonedev Onedev 代码问题漏洞
漏洞描述信息
Theonedev Onedev是Theonedev团队的一个基于JAVA的多合一DevOps平台。该平台支持容器构建、编排、CI、Git管理、团队协作等功能，帮助开发者构建一个简单、功能强大的开发平台。 OneDev before version 4.0.3 存在代码问题漏洞，攻击者可利用该漏洞运行任意代码。
CVSS信息
N/A
漏洞类别
代码问题