CVE-2021-37705: Incomplete Authorization Check in OneFuzz
Summary
CVE-2021-37705: OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Affects onefuzz across 2 version ranges.
>= 2.12.0, < 2.31.0
< 2fcb4998887959b4fa11894a068d689189742cb1
Fixed in 2fcb4998887959b4fa11894a068d689189742cb1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. It provides a framework for automated software testing and security analysis by generating and executing fuzzing jobs. OneFuzz allows users to identify vulnerabilities and crashes in their software applications. It is commonly used for security testing and is deployed as a service on Azure compute resources. OneFuzz versions 2.12.0 and above, when deployed with the non-default --multi_tenant_domain option, are vulnerable to an incomplete authorization check.
Vulnerability Detail
The vulnerability in OneFuzz allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. This can lead to read/write access to private data, including software vulnerability and crash information, security testing tools, and proprietary code and symbols. Additionally, it enables tampering with existing data and unauthorized code execution on Azure compute resources. The issue is resolved in release 2.31.0 by adding an application-level check of the bearer token's issuer against an administrator-configured allowlist.
How To Fix
Minimum fixed version
2fcb4998887959b4fa11894a068d689189742cb1
This is the first release that contains the fix.
pip install --upgrade "onefuzz==2fcb4998887959b4fa11894a068d689189742cb1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the tenant of a deployed OneFuzz instance with a version lower than 2.31.0 by redeploying it in the default configuration. This configuration omits the --multi_tenant_domain option, thereby limiting access to the specific tenant. However, this is not a permanent solution, and upgrading to the latest version is strongly recommended.
Conclusion
The incomplete authorization check vulnerability in OneFuzz can lead to unauthorized access and tampering with sensitive data. It is crucial to update to version 2.31.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for onefuzz →
FAQ
OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform used for automated software testing and security analysis.
OneFuzz versions 2.12.0 and above, deployed with the non-default --multi_tenant_domain option, are affected.
The vulnerability allows unauthorized access to private data, tampering with existing data, and unauthorized code execution on Azure compute resources.
To fix the vulnerability, update OneFuzz to version 2.31.0 or later.
Yes, as a temporary workaround, users can redeploy their OneFuzz instance in the default configuration without the --multi_tenant_domain option.
