CVE-2020-13953

Vulnerability

Overview

In Apache Tapestry versions 5.4.0 through 5.5.0, a path traversal vulnerability exists that allows an attacker to download files located within the WEB-INF folder of the deployed WAR application. This folder typically contains sensitive configuration files, classes, and JARs that should not be accessible from the web [1].

Exploitation

The vulnerability is triggered by crafting specific URLs that bypass access controls and allow the retrieval of files within the WEB-INF directory. The attacker does not require authentication to exploit this, as the vulnerable code processes the crafted URL without proper validation, exposing internal application resources [1].

Impact

Successful exploitation enables an attacker to read configuration files, source code, and other sensitive data stored in the WEB-INF folder. This can lead to further compromise by exposing application secrets, database credentials, or revealing code patterns that could be used for other attacks [1].

Mitigation

Users should upgrade to Apache Tapestry version 5.5.1 or later, which contains a fix for this vulnerability. No workarounds have been published by the vendor [1].