Cyber Resilience

CVE-2021-21243

RCE in Onedev Project Onedev ≤ 4.0.3

Published
15 January 2021
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 10.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS Score 0.54 99th percentile
Risk Priority 87 floored blend · peak EPSS

Summary

CVE-2021-21243 is a critical-severity Injection (CWE-74) vulnerability in Onedev Project Onedev. Its CVSS base score is 10.0 (Critical).

Operationally, ranked in the top 1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. These endpoints do not enforce any authentication or authorization checks. This issue may lead…

more

to pre-auth RCE. This issue was fixed in 4.0.3 by not using deserialization at KubernetesResource side.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Unauthenticated Kubernetes REST endpoints accept and deserialize attacker-controlled data, enabling remote code execution without credentials.
T1203 Exploitation for Client Execution Executionconfidence: HIGH
The deserialization flaw in the exposed REST endpoint directly allows exploitation for client-side code execution.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2021-21242Same product: Onedev Project Onedev
CVE-2024-3366Shared CWE-502, CWE-74
CVE-2025-58046Shared CWE-502, CWE-74
CVE-2025-27511Shared CWE-502, CWE-74
CVE-2024-1773Shared CWE-502, CWE-74
CVE-2026-27727Shared CWE-502, CWE-74
CVE-2025-30284Shared CWE-502
CVE-2025-42999Shared CWE-502
CVE-2024-13295Shared CWE-502
CVE-2024-42362Shared CWE-502

Affected Assets

onedev project
onedev
≤ 4.0.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V1.2.1
  • V1.2.3
  • V1.2.5
  • V1.2.8

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-74 CWE-502

Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.

addresses: CWE-502

Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.

addresses: CWE-502

Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.

addresses: CWE-502

Validates or rejects untrusted serialized data before deserialization occurs.

addresses: CWE-502

Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.

addresses: CWE-74

Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.

addresses: CWE-502

Integrity verification of serialized information can detect tampering before deserialization occurs.

addresses: CWE-502

Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and output encoding that prevent injection flaws.

PR.PS-02 none match
prevents

PR.PS-02 addresses only post-deployment updates/patching and cannot prevent introduction of unsafe deserialization code, yet it can remediate some instances when the flaw exists in outdated libraries or components.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing in development catches injection vulnerabilities before release.

A.8.15 Logging partial match
detects

Logging supports detection of injection attempts but does not prevent the weakness.

detects

Monitoring activities can identify active injection attacks after they occur.

prevents

Secure development life cycle mandates input validation and output encoding that directly prevent injection flaws.

prevents

Application security requirements explicitly call for controls against injection attacks in software design.

prevents

Secure architecture principles reduce injection surfaces but do not prescribe specific neutralization techniques.

References