cbcvebase.
CVE-2021-27850
published 2021-04-15

CVE-2021-27850: A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0…

PriorityP191critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
94.09%
99.8th percentile
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.

Affected

2 ranges
VendorProductVersion rangeFixed in
apachetapestry>= 5.4.0 < 5.6.25.6.2
apachetapestry>= 5.7.0 < 5.7.15.7.1

Detection & IOCsextracted from sources · hover to see the quote

url/assets/something/services/AppModule.class/
path/assets/app/something/services/AppModule.class/
filenameAppModule.class
  • Detect HTTP GET requests to asset paths ending with `.class/` (trailing slash bypass of blacklist filter). The slash is stripped server-side after the blacklist check, allowing class file download.
  • Alert on HTTP responses with Content-Type `application/java` to `/assets/` paths — indicates successful class file retrieval.
  • Response body containing both 'configuration' and 'webtools' strings alongside a 200 status confirms successful AppModule.class exfiltration.
  • After HMAC key extraction, watch for incoming deserialization payloads signed with the leaked key — particularly CommonsBeanUtils1 gadget chains from ysoserial.
  • The HMAC key in AppModule.class follows UUID format: 6 hex digits - 4 hex digits - 4 hex digits - 4 hex digits - 12 hex digits. Use regex to detect key extraction attempts.
  • ·The vulnerability only affects Apache Tapestry versions 5.4.5, 5.5.0, 5.6.2, and 5.7.0. The Metasploit module will fail to extract the HMAC key if it has been changed from the default UUID format.
  • ·The blacklist fix for CVE-2019-0195 checked for URLs ending in `.class`, `.properties`, or `.xml` — this bypass appends a trailing `/` which evades the check before being stripped server-side.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
ghsa9.8CRITICAL
osv9.8CRITICAL
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.