CVE-2021-27850_POC

CVE-2021-27850 漏洞利用 概述 CVE-2021-27850 是 Apache Tapestry 所有最新版本中发现的一个严重未经认证的远程代码执行漏洞。通过下载 AppModule.class 文件，我们可以泄露用于签名 Apache Tapestry 中所有序列化对象的 HMAC 密钥。 我们在一次真实环境评估中遇到了这个 CVE，并且据我所知，目前还没有关于 Tapestry 如何签名序列化对象的公开利用工具，因此我们决定发布以下 POC，这是我们在长时间研究 Apache Tapestry 源代码之后使用的 x。 使用方法 1- 克隆此仓库 2- 运行以下命令...

CVE-2019-0195

Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbo...

GHSA-6MWH-FW4P-75FJ Deserialization of Untrusted Data in Apache Tapestry

By manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this...

Apache Tapestry 代码问题漏洞

Apache Tapestry is the United States Apache Apache Foundation of a Web application framework written in the Java language . Apache Tapestry has a security vulnerability that can be exploited by an attacker to download the file "AppModule.class" by requesting the URL "http: localhost: 8080 assets...

CVE-2019-0195

Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbo...

Deserialization of untrusted data

Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbo...