S4E just found a high-severity finding from top 10 tcp port service scan
PlatformPlansPartners
Resources
ToolsBlogDocs
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Dec 16, 2023

CVE-2021-27850 Scanner

Detects 'Remote Code Execution (RCE)' vulnerability in Apache Software Foundation Apache Tapestry affects v. from 5.4.0 to 5.6.2 and from 5.7.0 to 5.7.1.

Est. Time~15 seconds
Scan TypeSingle Scan
Targetsurl
CostFree
2.8k
Times Used
continuous scan runs
4.7k
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
CVECVE-2021-27850
9.8
CVSS

A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.

Attack Vector
-
Privileges Req.
-
User Interaction
-
Affected
Apache Tapestryby Apache Software Foundation
Apache Tapestry 5.5.0
Updated Aug 21, 2026View on NVD →
Detail

Apache Tapestry is an open-source component-oriented web application framework that allows developers to build scalable and robust web applications. This framework simplifies the web application development process, by providing a set of reusable components and services that can be easily integrated into web applications. Apache Tapestry is widely used in the development community to create web applications of different complexities.

Recently, a critical unauthenticated remote code execution vulnerability, CVE-2021-27850 was detected in all recent versions of Apache Tapestry, including 5.4.5, 5.5.0, 5.6.2, and 5.7.0. This vulnerability bypasses the fix for CVE-2019-0195, where attackers could download arbitrary class files from the classpath by providing a crafted asset file URL. The blacklisting method introduced to fix CVE-2019-0195 vulnerability was not enough, which is why this vulnerability was discovered and exploited.

This remote code execution vulnerability can be used to execute arbitrary Java code on any affected server without authentication, leading to potential data breaches and thefts. The exploit could allow an attacker to inject unauthorized code in a compromised application, allowing the attacker to perform various malicious activities, including accessing sensitive data, taking remote control, and disrupting normal operations.

In conclusion, understanding the potential security threats to your digital assets is essential. The s4e.io platform provides users with advanced features that enable them to stay up-to-date with the latest vulnerabilities and security threats. By keeping up to date with the latest security threats and implementing the recommended security best practices, you can secure your digital assets effectively.

 

REFERENCES

Solution Advice

To protect against this vulnerability, Apache Tapestry recommends upgrading to version 5.6.2 or later for versions 5.4.0-5.6.1 and upgrading to 5.7.1 or later for version 5.7.0. Additionally, you can secure your applications using the below precautions:

  • Monitor your application for suspicious behavior and traffic.
  • Implement security patches and updates as soon as they are released.
  • Implement security measures like firewalls and intrusion detection systems.
  • Use secure coding practices such as input validation and output filtering.
  • Regularly audit your application for security vulnerabilities.

Get AI-powered remediation steps tailored to your asset.

Try AI Solutions →

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.