CVE-2019-0195
published 2019-09-16CVE-2019-0195: Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the…
PriorityP268critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
14.87%
96.3th percentile
Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbol could be used to craft a Java deserialization attack, thus running malicious injected Java code. The vector would be the t:formdata parameter from the Form component.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | tapestry | >= 5.4.0 < 5.6.2 | 5.6.2 |
| apache | tapestry | 5.4.0 – 5.4.3 | — |
| apache | tapestry | >= 5.7.0 < 5.7.1 | 5.7.1 |
| apache_software_foundation | apache_tapestry | — | — |
| apache_software_foundation | apache_tapestry | — | — |
| apache_software_foundation | apache_tapestry | >= Apache Tapestry 5.4.5 < Apache Tapestry 5.4.0* | Apache Tapestry 5.4.0* |
| apache_software_foundation | apache_tapestry | >= Apache Tapestry 5.6.2 < Apache Tapestry 5.6.0* | Apache Tapestry 5.6.0* |
Detection & IOCsextracted from sources · hover to see the quote
path/assets/app/something/services/AppModule.class/
path/assets/app/{{id}}/services/AppModule.class/
- →Detect HTTP GET requests to asset paths ending with `.class/` (trailing slash bypass of blacklist filter). The response Content-Type header will contain `application/java` and the body will contain strings such as `configuration` and `webtools`.
- →The bypass works by appending a trailing `/` to a `.class`, `.properties`, or `.xml` asset URL. The slash is stripped after the blacklist check, causing the file to be served. Monitor for asset URL requests ending with these extensions followed by a `/`. ↗
- →Successful exploitation leaks the HMAC secret key from AppModule.class, which can then be used to sign a malicious Java gadget chain (e.g., CommonsBeanUtils1 from ysoserial) for RCE. Correlate class file download events with subsequent deserialization payloads. ↗
- →Use the regex `\/assets\/app\/([a-z0-9]+)\/services\/AppMod` against HTTP response headers to extract the dynamic application context ID used in the exploit path.
- ·The vulnerability (CVE-2021-27850) is a bypass of the CVE-2019-0195 fix. The original fix used a blacklist checking for URLs ending in `.class`, `.properties`, or `.xml`, but this is trivially bypassed with a trailing `/`. Both CVEs share the same root attack surface. ↗
- ·Affected Apache Tapestry versions are 5.4.5, 5.5.0, 5.6.2, and 5.7.0. The nuclei template targets two requests — one with a static path and one with a dynamically extracted application context ID from the response header. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Deserialization of Untrusted Data in Apache Tapestry
osv·2022-05-24
CVE-2019-0195 [CRITICAL] Deserialization of Untrusted Data in Apache Tapestry
Deserialization of Untrusted Data in Apache Tapestry
By manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbol could be used to craft a Java deserialization attack, thus running malicious injected Java code. The vector would be the t:formdata parameter from the Form component.
GHSA
Deserialization of Untrusted Data in Apache Tapestry
ghsa·2022-05-24
CVE-2019-0195 [CRITICAL] CWE-502 Deserialization of Untrusted Data in Apache Tapestry
Deserialization of Untrusted Data in Apache Tapestry
By manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbol could be used to craft a Java deserialization attack, thus running malicious injected Java code. The vector would be the t:formdata parameter from the Form component.
OSV
Remote code execution in Apache Tapestry
osv·2021-06-16·CVSS 9.8
CVE-2021-27850 [CRITICAL] Remote code execution in Apache Tapestry
Remote code execution in Apache Tapestry
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed b
GHSA
Remote code execution in Apache Tapestry
ghsa·2021-06-16·CVSS 9.8
CVE-2021-27850 [CRITICAL] CWE-502 Remote code execution in Apache Tapestry
Remote code execution in Apache Tapestry
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed b
VulnCheck
Apache tapestry Exposure of Sensitive Information to an Unauthorized Actor
vulncheck·2021·CVSS 9.8
CVE-2021-27850 [CRITICAL] Apache tapestry Exposure of Sensitive Information to an Unauthorized Actor
Apache tapestry Exposure of Sensitive Information to an Unauthorized Actor
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist
No detection rules found.
Nuclei
Apache Tapestry - Remote Code Execution
nuclei·CVSS 9.8
CVE-2021-27850 [CRITICAL] Apache Tapestry - Remote Code Execution
Apache Tapestry - Remote Code Execution
Apache Tapestry contains a critical unauthenticated remote code execution vulnerability. Affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. Note that this vulnerability is a bypass of the fix for CVE-2019-0195. Before that fix it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL.
Template:
id: CVE-2021-27850
info:
name: Apache Tapestry - Remote Code Execution
author: pdteam
severity: critical
description: |
Apache Tapestry contains a critical unauthenticated remote code execution vulnerability. Affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. Note that this vulnerability is a bypass of the fix for CVE-2019-0195. Before that fix it was possible to download arbitrary class files fr
No writeups or analysis indexed.
http://www.openwall.com/lists/oss-security/2021/04/15/1https://lists.apache.org/thread.html/5173c4eed06e2fca6fd5576ed723ff6bb1711738ec515cb51a04ab24%40%3Cusers.tapestry.apache.org%3Ehttps://lists.apache.org/thread.html/6c40c1e03d2131119f9b77882431a0050f02bf9cae9ee48b84d012df%40%3Cusers.tapestry.apache.org%3Ehttps://lists.apache.org/thread.html/a4092cb3bacb143571024e79c0016c039b6c982423daa33a7a5c794a%40%3Cusers.tapestry.apache.org%3Ehttps://lists.apache.org/thread.html/r237ff7f286bda31682c254550c1ebf92b0ec61329b32fbeb2d1c8751%40%3Cusers.tapestry.apache.org%3Ehttps://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c%40%3Ccommits.tapestry.apache.org%3Ehttps://lists.apache.org/thread.html/r87523dd07886223aa086edc25fe9b8ddb9c1090f7db25b068dc30843%40%3Ccommits.tapestry.apache.org%3Ehttp://www.openwall.com/lists/oss-security/2021/04/15/1https://lists.apache.org/thread.html/5173c4eed06e2fca6fd5576ed723ff6bb1711738ec515cb51a04ab24%40%3Cusers.tapestry.apache.org%3Ehttps://lists.apache.org/thread.html/6c40c1e03d2131119f9b77882431a0050f02bf9cae9ee48b84d012df%40%3Cusers.tapestry.apache.org%3Ehttps://lists.apache.org/thread.html/a4092cb3bacb143571024e79c0016c039b6c982423daa33a7a5c794a%40%3Cusers.tapestry.apache.org%3Ehttps://lists.apache.org/thread.html/r237ff7f286bda31682c254550c1ebf92b0ec61329b32fbeb2d1c8751%40%3Cusers.tapestry.apache.org%3Ehttps://lists.apache.org/thread.html/r7d9c54beb1dc97dcccc58d9b5d31f0f7166f9a25ad1beba5f8091e0c%40%3Ccommits.tapestry.apache.org%3Ehttps://lists.apache.org/thread.html/r87523dd07886223aa086edc25fe9b8ddb9c1090f7db25b068dc30843%40%3Ccommits.tapestry.apache.org%3E
2019-09-16
Published