Vulnerability record · CVE-2021-27850 · published 15 April 2021
CVE-2021-27850: Apache Tapestry unauthenticated RCE via asset URL blacklist bypass
Apache · Tapestry
Apache Tapestry's fix for CVE-2019-0195 used a blacklist that blocks asset URLs ending in .class, .properties or .xml, but appending a trailing slash bypasses the check and still returns the file. An attacker can retrieve AppModule.class, extract the HMAC secret used to sign serialized Java objects, and forge a signed gadget chain. The flaw is unauthenticated and network-reachable, making it a full remote code execution path.
Description
A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityUnauthenticated network-reachable remote code execution with a CVSS of 9.8 and very high EPSS probability, with public exploit references available.
What it is
Apache Tapestry's fix for CVE-2019-0195 used a blacklist that blocks asset URLs ending in .class, .properties or .xml, but appending a trailing slash bypasses the check and still returns the file. An attacker can retrieve AppModule.class, extract the HMAC secret used to sign serialized Java objects, and forge a signed gadget chain. The flaw is unauthenticated and network-reachable, making it a full remote code execution path.
Impact
An attacker gains the HMAC signing key and can submit a signed malicious serialized object, achieving remote code execution with the privileges of the Tapestry application. This yields full compromise of confidentiality, integrity and availability on the affected server.
Attack surface
Reached over HTTP by requesting a crafted asset URL such as /assets/.../AppModule.class/ on a Tapestry application. No authentication and no user interaction are required; the CVSS vector is AV:N/AC:L/PR:N/UI:N.
Exploitation
Not listed in CISA KEV, but EPSS is 0.93471 (99.8th percentile) and references carry an Exploit tag, indicating public exploit material and high likelihood of attempted exploitation.
What to do
- Upgrade Apache Tapestry: 5.4.0 through 5.6.1 to 5.6.2 or later, and 5.7.0 to 5.7.1 or later.
- If immediate upgrade is not possible, block or reject requests whose asset paths end in .class, .properties or .xml with a trailing slash at the reverse proxy or WAF.
- Rotate the Tapestry HMAC signing secret after patching, since exposure of the key must be assumed.
- Restrict outbound and inbound access to the Tapestry application to trusted networks where feasible.
- Inventory all Tapestry deployments and confirm no instance remains on an affected version.
Detection
- Search web access logs for requests to /assets/ paths ending in .class/, .properties/ or .xml/, especially AppModule.class/.
- Alert on HTTP 200 responses to asset URLs containing .class or .properties, which should not normally be served.
- Monitor for deserialization errors or unexpected gadget-chain class loading in application and JVM logs.
- Watch for anomalous outbound connections or process execution from the Tapestry application host after asset requests.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2021/04/15/1 | ExploitMailing ListThird Party Advisory |
| https://lists.apache.org/thread.html/r237ff7f286bda31682c254550c1ebf92b0ec61329b32fbeb2d1c8751%40%3Cusers.tapestry.apach | Mailing ListVendor Advisory |
| https://security.netapp.com/advisory/ntap-20210528-0002/ | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2021/04/15/1 | ExploitMailing ListThird Party Advisory |
| https://lists.apache.org/thread.html/r237ff7f286bda31682c254550c1ebf92b0ec61329b32fbeb2d1c8751%40%3Cusers.tapestry.apach | Mailing ListVendor Advisory |
| https://security.netapp.com/advisory/ntap-20210528-0002/ | Third Party Advisory |
Track CVE-2021-27850 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-27850), CISA KEV, FIRST EPSS (scores of 2026-09-25). This page is refreshed as NVD updates the record.
