CVE-2021-27850— Apache Tapestry 代码问题漏洞
一分钟漏洞结论
影响对象
Apache Software Foundation Apache Tapestry
利用判断
存在公开或 AI PoC，应优先验证
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Apache Tapestry是美国阿帕奇（Apache）基金会的一款使用Java语言编写的Web应用程序框架。 Apache Tapestry 5.7.0, upgrade to 5.7.1 or later 存在安全漏洞，攻击者可利用该漏洞可以通过请求URL“http: localhost:8080 assets something services AppModule.class”下载文件“AppModule.class”，该URL包含一个HMAC密钥。
公开利用映射 2
Metasploit · 1
cve_2021_27850_apache_tapestry_hmac_key.rb [auxiliary]
Nuclei · 1
CVE-2021-27850.yaml [template]
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2021-27850 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Bypass of the fix for CVE-2019-0195
来源: CVE Program / CVE List V5
Vulnerability Description
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
信息暴露
来源: CVE Program / CVE List V5
Vulnerability Title
Apache Tapestry 代码问题漏洞
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Description
Apache Tapestry是美国阿帕奇（Apache）基金会的一款使用Java语言编写的Web应用程序框架。 Apache Tapestry 5.7.0, upgrade to 5.7.1 or later 存在安全漏洞，攻击者可利用该漏洞可以通过请求URL“http: localhost:8080 assets something services AppModule.class”下载文件“AppModule.class”，该URL包含一个HMAC密钥。
来源: 中国国家信息安全漏洞库 CNNVD
CVSS Information
N/A
来源: 中国国家信息安全漏洞库 CNNVD
Vulnerability Type
N/A
来源: 中国国家信息安全漏洞库 CNNVD
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Apache Software Foundation | Apache Tapestry | Apache Tapestry 5.5.0 | - |
|
二、漏洞 CVE-2021-27850 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | A Proof of concept for CVE-2021-27850 affecting Apache Tapestry and leading to unauthencticated remote code execution. | https://github.com/kahla-sec/CVE-2021-27850_POC | POC详情 |
| 2 | A Proof of concept for CVE-2021-27850 affecting Apache Tapestry and leading to unauthencticated remote code execution. | https://github.com/dorkerdevil/CVE-2021-27850_POC | POC详情 |
| 3 | Apache Tapestry CVE-2021-27850 PoC | https://github.com/Ovi3/CVE_2021_27850_POC | POC详情 |
| 4 | CVE-2021-27850 ysoserial | https://github.com/novysodope/CVE-2021-27850 | POC详情 |
| 5 | Apache Tapestry contains a critical unauthenticated remote code execution vulnerability. Affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. Note that this vulnerability is a bypass of the fix for CVE-2019-0195. Before that fix it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-27850.yaml | POC详情 |
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2021-27850 的情报信息
请登录查看更多情报信息。
CVE-2021-27850 厂商安全公告 (1)
-
https://security.netapp.com/advisory/ntap-20210528-0002/ x_refsource_CONFIRM
CVE-2021-27850 邮件列表归档 (2)
IV. Related Vulnerabilities
Same vendor: Apache Software Foundation
-
CVE-2026-63686
Apache HTTP Server: mod_xml2enc crash on charset conversion -
CVE-2026-93546
Apache HTTP Server: mod_dav_fs namespace overflow -
CVE-2026-79768
Apache HTTP Server: mod_userdir information disclosure -
CVE-2026-73637
Apache HTTP Server: mod_auth_digest DoS attack -
CVE-2026-73636
Apache HTTP Server: mod_auth_digest one-time-nonce replay at
Same weakness: CWE-200
-
CVE-2026-67172
HCL BigFix Service Management is affected by multiple securi -
CVE-2026-67171
HCL BigFix Service Management is affected by multiple securi -
CVE-2026-47360
Apache HTTP Server: mod_session: Session cookie not removed -
CVE-2026-67106
HCL BigFix Service Management 多个安全漏洞 -
CVE-2026-67104
HCL BigFix Service Management 多个安全漏洞
V. Comments for CVE-2021-27850
暂无评论