CVE-2021-21246 PoC — Theonedev Onedev 信息泄露漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-21246.yaml

Associated Vulnerability

Title:Theonedev Onedev 信息泄露漏洞 (CVE-2021-21246)
Description:Theonedev Onedev是Theonedev团队的一个基于JAVA的多合一DevOps平台。该平台支持容器构建、编排、CI、Git管理、团队协作等功能，帮助开发者构建一个简单、功能强大的开发平台。 Theonedev Onedev before version 4.0.3 存在信息泄露漏洞，攻击者可利用该漏洞访问敏感数据。

Description

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/{id}, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions.

File Snapshot


 id: CVE-2021-21246

info:
  name: OneDev < 4.0.3 - User Access Token Leak
  author: DhiyaneshDk
  se

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!