{"id":"CVE-2021-37705","aliases":["GHSA-q5vh-6whw-x745","PYSEC-2021-344"],"title":"Improper Authorization and Origin Validation Error in OneFuzz","summary":"Improper Authorization and Origin Validation Error in OneFuzz","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L","vendor":"onefuzz","product":"onefuzz","ecosystem":"pip","affected":["onefuzz >= 2.12.0, < 2.31.0"],"patched":["onefuzz 2.31.0"],"published":"2021-08-13","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-q5vh-6whw-x745","references":[{"url":"https://github.com/microsoft/onefuzz/security/advisories/GHSA-q5vh-6whw-x745"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37705"},{"url":"https://github.com/microsoft/onefuzz/pull/1153"},{"url":"https://github.com/microsoft/onefuzz/commit/2fcb4998887959b4fa11894a068d689189742cb1"},{"url":"https://github.com/microsoft/onefuzz"},{"url":"https://github.com/microsoft/onefuzz/releases/tag/2.31.0"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/onefuzz/PYSEC-2021-344.yaml"},{"url":"https://pypi.org/project/onefuzz"}],"tags":["osv","pip"],"epss":0.02415,"epssPercentile":0.83283,"ingestedAt":"2026-07-08T18:25:52.101Z","slug":"CVE-2021-37705","body":"## Overview\n\n## Impact\n\nStarting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance.\n\nTo be vulnerable, a OneFuzz deployment must be:\n* Version 2.12.0 or greater\n* Deployed with the non-default [`--multi_tenant_domain`](https://github.com/microsoft/onefuzz/blob/2.30.0/src/deployment/deploy.py#L1021) option\n\nThis can result in read/write access to private data such as:\n* Software vulnerability and crash information\n* Security testing tools\n* Proprietary code and symbols\n\nVia authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources.\n\n## Patches\n\nThis issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token's `issuer` against an administrator-configured allowlist.\n\n## Workarounds\n\nUsers can restrict access to the tenant of a deployed OneFuzz instance < 2.31.0 by redeploying in the default configuration, which omits the `--multi_tenant_domain` option.\n\n## References\n\nYou can find an overview of the Microsoft Identity Platform [here](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview).  This vulnerability applies to the multi-tenant application pattern, as described [here](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant).\n\n## For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [OneFuzz](https://github.com/microsoft/onefuzz)\n* Email us at [fuzzing@microsoft.com](mailto:fuzzing@microsoft.com)\n\n## Affected packages\n\n- `onefuzz >= 2.12.0, < 2.31.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `onefuzz 2.31.0`","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":55,"likelihood":0.5,"exploitation":0,"ransomware":0},"changes":[]}