{"id":"GHSA-q5vh-6whw-x745","summary":"Improper Authorization and Origin Validation Error in OneFuzz","details":"## Impact\n\nStarting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance.\n\nTo be vulnerable, a OneFuzz deployment must be:\n* Version 2.12.0 or greater\n* Deployed with the non-default [`--multi_tenant_domain`](https://github.com/microsoft/onefuzz/blob/2.30.0/src/deployment/deploy.py#L1021) option\n\nThis can result in read/write access to private data such as:\n* Software vulnerability and crash information\n* Security testing tools\n* Proprietary code and symbols\n\nVia authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources.\n\n## Patches\n\nThis issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token's `issuer` against an administrator-configured allowlist.\n\n## Workarounds\n\nUsers can restrict access to the tenant of a deployed OneFuzz instance \u003c 2.31.0 by redeploying in the default configuration, which omits the `--multi_tenant_domain` option.\n\n## References\n\nYou can find an overview of the Microsoft Identity Platform [here](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview).  This vulnerability applies to the multi-tenant application pattern, as described [here](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant).\n\n## For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [OneFuzz](https://github.com/microsoft/onefuzz)\n* Email us at [fuzzing@microsoft.com](mailto:fuzzing@microsoft.com)","aliases":["CVE-2021-37705","PYSEC-2021-344"],"modified":"2026-05-07T05:02:24.243872753Z","published":"2021-08-13T20:16:32Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2021-08-13T20:16:08Z","nvd_published_at":"2021-08-13T21:15:00Z","cwe_ids":["CWE-285","CWE-346","CWE-863"]},"references":[{"type":"WEB","url":"https://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37705"},{"type":"WEB","url":"https://github.com/microsoft/onefuzz/pull/1153"},{"type":"WEB","url":"https://github.com/microsoft/onefuzz/commit/2fcb4998887959b4fa11894a068d689189742cb1"},{"type":"WEB","url":"https://github.com/microsoft/onefuzz"},{"type":"WEB","url":"https://github.com/microsoft/onefuzz/releases/tag/2.31.0"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/onefuzz/PYSEC-2021-344.yaml"},{"type":"WEB","url":"https://pypi.org/project/onefuzz"}],"affected":[{"package":{"name":"onefuzz","ecosystem":"PyPI","purl":"pkg:pypi/onefuzz"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.0"},{"fixed":"2.31.0"}]}],"versions":["2.12.0","2.13.0","2.14.0","2.15.0","2.16.0","2.17.0","2.18.0","2.19.0","2.20.0","2.21.0","2.22.0","2.23.0","2.23.1","2.24.0","2.25.0","2.25.1","2.26.0","2.26.1","2.27.0","2.28.0","2.29.0","2.29.1","2.30.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/08/GHSA-q5vh-6whw-x745/GHSA-q5vh-6whw-x745.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L"}]}