CVE-2021-37705 Information

Description

OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable a OneFuzz deployment must be both version 2.12.0 or greater and deployed with the non-default –multi_tenant_domain option. This can result in read/write access to private data such as software vulnerability and crash information security testing tools and proprietary code and symbols. Via authorized API calls this also enables tampering with existing data and unauthorized code execution on Azure compute resources. This issue is resolved starting in release 2.31.0 via the addition of application-level check of the bearer token’s issuer against an administrator-configured allowlist. As a workaround users can restrict access to the tenant of a deployed OneFuzz instance < 2.31.0 by redeploying in the default configuration which omits the --multi_tenant_domain option.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Reference

https://github.com/microsoft/onefuzz/releases/tag/2.31.0 https://github.com/microsoft/onefuzz/pull/1153 https://pypi.org/project/onefuzz/ https://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745 https://github.com/microsoft/onefuzz/commit/2fcb4998887959b4fa11894a068d689189742cb1

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

CHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

10.0