CVE-2021-21242: OneDev AttachmentUploadServlet deserialization allows pre-auth RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityPre-auth network-reachable remote code execution with a CVSS of 9.8 and very high EPSS makes this an urgent patch target.

What it is

OneDev before 4.0.3 exposes AttachmentUploadServlet, which deserializes untrusted data from the Attachment-Support header without any authentication or authorization checks. Because the servlet is reachable pre-auth and the input is deserialized, an unauthenticated network attacker can achieve remote code execution. The flaw was fixed in 4.0.3 by removing the servlet and eliminating the deserialization path.

Impact

An attacker gains remote code execution on the OneDev server without credentials, which can lead to full compromise of the host and any data or credentials it holds.

Attack surface

Reachable over the network via HTTP requests to AttachmentUploadServlet, with no authentication and no user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The malicious payload is carried in the Attachment-Support header.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is very high (0.74191, 99.46th percentile), indicating strong likelihood of exploitation activity.

What to do

• Upgrade OneDev to 4.0.3 or later, which removes AttachmentUploadServlet and the deserialization path.
• If immediate upgrade is not possible, block or restrict network access to AttachmentUploadServlet at the reverse proxy or WAF.
• Do not expose the OneDev instance directly to the internet; place it behind authentication and network controls.
• After patching, review logs for prior requests to AttachmentUploadServlet and treat any as potential compromise.
• Rotate secrets and credentials stored or accessible on the OneDev host if exploitation is suspected.

Detection

• Search HTTP access logs for requests to AttachmentUploadServlet, especially with an Attachment-Support header.
• Alert on unexpected outbound connections or child processes spawned by the OneDev Java process.
• Monitor for anomalous file writes or new executables in OneDev application and temp directories.
• Review OneDev and host logs around the patch window for signs of prior exploitation attempts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.