Vulnerability-Lookup

CNVD-2021-102868

Vulnerability from cnvd - Published: 2021-12-28

Title

Microsoft OneFuzz存在未明漏洞

Description

Microsoft OneFuzz是美国微软（Microsoft）公司的一个跨平台的免费和开源的模糊测试框架。 Microsoft OneFuzz 2.12.0到2.31.0版本存在安全漏洞，该漏洞源于受影响产品版本中存在不完整的授权检查，任何经过验证的用户都可以通过授权接口调用，进行私有数据的读写访问，并且可以篡改现有数据以及在Azure计算资源，攻击者可利用漏洞执行未授权的代码。

Severity

中

Patch Name

Microsoft OneFuzz存在未明漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-37705

Impacted products

Name
Microsoft OneFuzz >=2.12.0，<=2.31.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-37705"
    }
  },
  "description": "Microsoft OneFuzz\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u8de8\u5e73\u53f0\u7684\u514d\u8d39\u548c\u5f00\u6e90\u7684\u6a21\u7cca\u6d4b\u8bd5\u6846\u67b6\u3002\n\nMicrosoft OneFuzz 2.12.0\u52302.31.0\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u53d7\u5f71\u54cd\u4ea7\u54c1\u7248\u672c\u4e2d\u5b58\u5728\u4e0d\u5b8c\u6574\u7684\u6388\u6743\u68c0\u67e5\uff0c\u4efb\u4f55\u7ecf\u8fc7\u9a8c\u8bc1\u7684\u7528\u6237\u90fd\u53ef\u4ee5\u901a\u8fc7\u6388\u6743\u63a5\u53e3\u8c03\u7528\uff0c\u8fdb\u884c\u79c1\u6709\u6570\u636e\u7684\u8bfb\u5199\u8bbf\u95ee\uff0c\u5e76\u4e14\u53ef\u4ee5\u7be1\u6539\u73b0\u6709\u6570\u636e\u4ee5\u53ca\u5728Azure\u8ba1\u7b97\u8d44\u6e90\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u6267\u884c\u672a\u6388\u6743\u7684\u4ee3\u7801\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-102868",
  "openTime": "2021-12-28",
  "patchDescription": "Microsoft OneFuzz\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u7684\u4e00\u4e2a\u8de8\u5e73\u53f0\u7684\u514d\u8d39\u548c\u5f00\u6e90\u7684\u6a21\u7cca\u6d4b\u8bd5\u6846\u67b6\u3002\r\n\r\nMicrosoft OneFuzz 2.12.0\u52302.31.0\u7248\u672c\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u53d7\u5f71\u54cd\u4ea7\u54c1\u7248\u672c\u4e2d\u5b58\u5728\u4e0d\u5b8c\u6574\u7684\u6388\u6743\u68c0\u67e5\uff0c\u4efb\u4f55\u7ecf\u8fc7\u9a8c\u8bc1\u7684\u7528\u6237\u90fd\u53ef\u4ee5\u901a\u8fc7\u6388\u6743\u63a5\u53e3\u8c03\u7528\uff0c\u8fdb\u884c\u79c1\u6709\u6570\u636e\u7684\u8bfb\u5199\u8bbf\u95ee\uff0c\u5e76\u4e14\u53ef\u4ee5\u7be1\u6539\u73b0\u6709\u6570\u636e\u4ee5\u53ca\u5728Azure\u8ba1\u7b97\u8d44\u6e90\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u6267\u884c\u672a\u6388\u6743\u7684\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft OneFuzz\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Microsoft OneFuzz \u003e=2.12.0\uff0c\u003c=2.31.0"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-37705",
  "serverity": "\u4e2d",
  "submitTime": "2021-08-17",
  "title": "Microsoft OneFuzz\u5b58\u5728\u672a\u660e\u6f0f\u6d1e"
}

CVE-2021-37705 (GCVE-0-2021-37705)

Vulnerability from cvelistv5 – Published: 2021-08-13 20:15 – Updated: 2024-08-04 01:23

Title

Improper Authorization and Origin Validation Error in OneFuzz

Summary

OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable, a OneFuzz deployment must be both version 2.12.0 or greater and deployed with the non-default --multi_tenant_domain option. This can result in read/write access to private data such as software vulnerability and crash information, security testing tools and proprietary code and symbols. Via authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources. This issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token's `issuer` against an administrator-configured allowlist. As a workaround users can restrict access to the tenant of a deployed OneFuzz instance < 2.31.0 by redeploying in the default configuration, which omits the `--multi_tenant_domain` option.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

CWE

CWE-285 - Improper Authorization
CWE-346 - Origin Validation Error

Assigner

GitHub_M mitre root

References

5 references

URL	Tags
https://github.com/microsoft/onefuzz/security/adv…	x_refsource_CONFIRM
https://github.com/microsoft/onefuzz/pull/1153	x_refsource_MISC
https://github.com/microsoft/onefuzz/commit/2fcb4…	x_refsource_MISC
https://github.com/microsoft/onefuzz/releases/tag…	x_refsource_MISC
https://pypi.org/project/onefuzz/	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
microsoft	onefuzz	Affected: >= 2.12.0, < 2.31.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T01:23:01.448Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/microsoft/onefuzz/pull/1153"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/microsoft/onefuzz/commit/2fcb4998887959b4fa11894a068d689189742cb1"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/microsoft/onefuzz/releases/tag/2.31.0"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://pypi.org/project/onefuzz/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "onefuzz",
          "vendor": "microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.12.0, \u003c 2.31.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable, a OneFuzz deployment must be both version 2.12.0 or greater and deployed with the non-default --multi_tenant_domain option. This can result in read/write access to private data such as software vulnerability and crash information, security testing tools and proprietary code and symbols. Via authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources. This issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token\u0027s `issuer` against an administrator-configured allowlist. As a workaround users can restrict access to the tenant of a deployed OneFuzz instance \u003c 2.31.0 by redeploying in the default configuration, which omits the `--multi_tenant_domain` option."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-13T20:15:11.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoft/onefuzz/pull/1153"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoft/onefuzz/commit/2fcb4998887959b4fa11894a068d689189742cb1"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/microsoft/onefuzz/releases/tag/2.31.0"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pypi.org/project/onefuzz/"
        }
      ],
      "source": {
        "advisory": "GHSA-q5vh-6whw-x745",
        "discovery": "UNKNOWN"
      },
      "title": "Improper Authorization and Origin Validation Error in OneFuzz",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-37705",
          "STATE": "PUBLIC",
          "TITLE": "Improper Authorization and Origin Validation Error in OneFuzz"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "onefuzz",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 2.12.0, \u003c 2.31.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "microsoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable, a OneFuzz deployment must be both version 2.12.0 or greater and deployed with the non-default --multi_tenant_domain option. This can result in read/write access to private data such as software vulnerability and crash information, security testing tools and proprietary code and symbols. Via authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources. This issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token\u0027s `issuer` against an administrator-configured allowlist. As a workaround users can restrict access to the tenant of a deployed OneFuzz instance \u003c 2.31.0 by redeploying in the default configuration, which omits the `--multi_tenant_domain` option."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285: Improper Authorization"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-346: Origin Validation Error"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745",
              "refsource": "CONFIRM",
              "url": "https://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745"
            },
            {
              "name": "https://github.com/microsoft/onefuzz/pull/1153",
              "refsource": "MISC",
              "url": "https://github.com/microsoft/onefuzz/pull/1153"
            },
            {
              "name": "https://github.com/microsoft/onefuzz/commit/2fcb4998887959b4fa11894a068d689189742cb1",
              "refsource": "MISC",
              "url": "https://github.com/microsoft/onefuzz/commit/2fcb4998887959b4fa11894a068d689189742cb1"
            },
            {
              "name": "https://github.com/microsoft/onefuzz/releases/tag/2.31.0",
              "refsource": "MISC",
              "url": "https://github.com/microsoft/onefuzz/releases/tag/2.31.0"
            },
            {
              "name": "https://pypi.org/project/onefuzz/",
              "refsource": "MISC",
              "url": "https://pypi.org/project/onefuzz/"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-q5vh-6whw-x745",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-37705",
    "datePublished": "2021-08-13T20:15:11.000Z",
    "dateReserved": "2021-07-29T00:00:00.000Z",
    "dateUpdated": "2024-08-04T01:23:01.448Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2021-102868

CVE-2021-37705 (GCVE-0-2021-37705)

Tags

Sightings

Nomenclature

Related by attack behaviour