Read the docs
TI-2021-09208 Aliases CVE-2021-27850GHSA-mj8x-cpr8-x39h

Bypass of the fix for CVE-2019-0195

Priority CRITICAL 86CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-502.

Summary

A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.

Why it matters now

EPSS 0.9356 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.apache.tapestry:tapestry-core (Maven): 5.6.3, 5.7.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache TapestryApache Tapestry 5.5.0; Apache Tapestry 5.7.0; Apache Tapestry 5.4.5 and later; Apache Tapestry 5.6.2 and later—No fix listedCNA
—org.apache.tapestry:tapestry-core (Maven)5.4.0 to before 5.6.35.6.3Patch availableGHSA-mj8x-cpr8-x39h
—org.apache.tapestry:tapestry-core (Maven)5.7.0 to before 5.7.15.7.1Patch availableGHSA-mj8x-cpr8-x39h
  • Apache Tapestry VendorApache Affected Apache Tapestry 5.5.0; Apache Tapestry 5.7.0; Apache Tapestry 5.4.5 and later; Apache Tapestry 5.6.2 and later Fixed in — No fix listed CNA
  • org.apache.tapestry:tapestry-core (Maven) Vendor— Affected 5.4.0 to before 5.6.3 Fixed in 5.6.3 Patch available GHSA-mj8x-cpr8-x39h
  • org.apache.tapestry:tapestry-core (Maven) Vendor— Affected 5.7.0 to before 5.7.1 Fixed in 5.7.1 Patch available GHSA-mj8x-cpr8-x39h

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:tapestry:*:*:*:*:*:*:*:*5.4.0 to before 5.6.2; 5.7.0 to before 5.7.1VulnerableApache
  • cpe:2.3:a:apache:tapestry:*:*:*:*:*:*:*:* Versions 5.4.0 to before 5.6.2; 5.7.0 to before 5.7.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-mj8x-cpr8-x39h org.apache.tapestry:tapestry-core (Maven) Fixed in 5.6.3 Advisory →
  • Fix · GHSA-mj8x-cpr8-x39h org.apache.tapestry:tapestry-core (Maven) Fixed in 5.7.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-27850
  2. 2026-10-03 Alias added: GHSA-mj8x-cpr8-x39h

References

Exploit 1

Advisory 3

Other 2

  • TI-2019-00172 Deserialization of untrusted data in Apache Tapestry CVSS 3.1CRITICAL 9.8
  • TI-2020-13279 Deserialization flaw in EOL Tapestry 4. CVSS 3.1CRITICAL 9.8
  • TI-2019-07397 Observable discrepancy in Apache Tapestry CVSS 3.1CRITICAL 9.8
  • TI-2022-22909 Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input CVSS 3.1CRITICAL 9.8
  • TI-2014-01541 Apache Tapestry before 5.3.6 relies on client-side object storage without checking… CVSS 2.0HIGH 7.8
  • TI-2021-11029 An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later CVSS 3.1HIGH 7.5
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences