Vulnerability · Published Aug 13, 2021 · Assigned by GitHub_M
CVE-2021-37705Improper Authorization and Origin Validation Error in OneFuzz
Critical 10.0
In plain English
A critical-severity security flaw in onefuzz from microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable, a OneFuzz deployment must be both version 2.12.0 or greater and deployed with the non-default --multi_tenant_domain option. This can result in read/write access to private data such as software vulnerability and crash information, security testing tools and proprietary code and symbols. Via authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources. This issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token's `issuer` against an administrator-configured allowlist. As a workaround users can restrict access to the tenant of a deployed OneFuzz instance < 2.31.0 by redeploying in the default configuration, which omits the `--multi_tenant_domain` option.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | onefuzz | 2.31.0 | GHSA-q5vh-6whw-x745 |
| PyPI | onefuzz | 2.31.0 | PYSEC-2021-344 |
Affected products (as reported)
Weakness: CWE-285, CWE-346 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
References
- https://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745 x_refsource_CONFIRM
- https://github.com/microsoft/onefuzz/pull/1153 x_refsource_MISC
- https://github.com/microsoft/onefuzz/commit/2fcb4998887959b4fa11894a068d689189742cb1 x_refsource_MISC
- https://github.com/microsoft/onefuzz/releases/tag/2.31.0 x_refsource_MISC
- https://pypi.org/project/onefuzz/ x_refsource_MISC