Vulnerability Description
OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable, a OneFuzz deployment must be both version 2.12.0 or greater and deployed with the non-default --multi_tenant_domain option. This can result in read/write access to private data such as software vulnerability and crash information, security testing tools and proprietary code and symbols. Via authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources. This issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token's `issuer` against an administrator-configured allowlist. As a workaround users can restrict access to the tenant of a deployed OneFuzz instance < 2.31.0 by redeploying in the default configuration, which omits the `--multi_tenant_domain` option.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Onefuzz | >= 2.12.0, < 2.31.0 |
Related Weaknesses (CWE)
References
- https://github.com/microsoft/onefuzz/commit/2fcb4998887959b4fa11894a068d68918974PatchThird Party Advisory
- https://github.com/microsoft/onefuzz/pull/1153PatchThird Party Advisory
- https://github.com/microsoft/onefuzz/releases/tag/2.31.0Release NotesThird Party Advisory
- https://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745Third Party Advisory
- https://pypi.org/project/onefuzz/Product
- https://github.com/microsoft/onefuzz/commit/2fcb4998887959b4fa11894a068d68918974PatchThird Party Advisory
- https://github.com/microsoft/onefuzz/pull/1153PatchThird Party Advisory
- https://github.com/microsoft/onefuzz/releases/tag/2.31.0Release NotesThird Party Advisory
- https://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745Third Party Advisory
- https://pypi.org/project/onefuzz/Product
FAQ
What is CVE-2021-37705?
CVE-2021-37705 is a vulnerability with a CVSS score of 10.0 (CRITICAL). OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Direc...
How severe is CVE-2021-37705?
CVE-2021-37705 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-37705?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Onefuzz.