Bypass of the fix for CVE-2019-0195

Vulnerability

A critical unauthenticated remote code execution vulnerability exists in Apache Tapestry versions 5.4.5, 5.5.0, 5.6.2, and 5.7.0. The vulnerability is a bypass of the fix for CVE-2019-0195, where a blacklist filter blocking .class, .properties, and .xml file extensions can be circumvented by appending a trailing slash to the URL. This allows an attacker to download arbitrary class files from the classpath, such as AppModule.class, which contains an HMAC secret key. The blacklist filter fails because the trailing slash is stripped after the filter check. [1][3]

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to the Tapestry application's asset URL, e.g., http://localhost:8080/assets/something/services/AppModule.class/. The trailing slash bypasses the blacklist, and the server serves the AppModule.class file. With the HMAC secret key obtained from that file, the attacker can sign a malicious Java serialized object (e.g., using CommonsBeanUtils1 from ysoserial) and send it to the server, resulting in remote code execution. No authentication is required. [1][3]

Impact

Successful exploitation allows an unauthenticated attacker to achieve remote code execution on the Tapestry server with the privileges of the application. The attacker can execute arbitrary Java code, potentially leading to full compromise of the application and underlying system. The attack does not require any prior access or user interaction. [1]

Mitigation

For Apache Tapestry versions 5.4.0 to 5.6.1, upgrade to version 5.6.2 or later. For version 5.7.0, upgrade to 5.7.1 or later. These patched versions properly ignore trailing slashes in asset URLs. [1][2][3] No workaround is available aside from upgrading.