Description
Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbol could be used to craft a Java deserialization attack, thus running malicious injected Java code. The vector would be the t:formdata parameter from the Form component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Tapestry | Apache Tapestry 5.4.0 to 5.4.3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.tapestry:tapestry-core | >= 5.4.0, < 5.4.5 | 5.4.5 | GHSA-6mwh-fw4p-75fj |
References
- [tapestry-users] 20190913 [CVE-2019-0195] Apache Tapestry vulnerability disclosure mailing-list
- [tapestry-users] 20191007 Re: [CVE-2019-0195] Apache Tapestry vulnerability disclosure mailing-list
- [tapestry-users] 20191014 Re: [CVE-2019-0195] Apache Tapestry vulnerability disclosure mailing-list
- [tapestry-commits] 20200111 svn commit: r1055136 [2/2] - in /websites/production/tapestry/content: cache/main.pageCache component-rendering.html content-type-and-markup.html dom.html https.html request-processing.html response-compression.html securi mailing-list
- [tapestry-commits] 20200531 svn commit: r1061326 [4/4] - in /websites/production/tapestry/content: ./ cache/ mailing-list
- [tapestry-users] 20210414 [SECURITY VULNERABILITY DISCLOSURE] CVE-2021-27850: Apache Tapestry: Bypass of the fix for CVE-2019-0195 mailing-list
- [oss-security] 20210414 CVE-2021-27850: Apache Tapestry: Bypass of the fix for CVE-2019-0195 mailing-list