An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later

Vulnerability

An information exposure vulnerability exists in the context asset handling of Apache Tapestry [1][2]. The flaw resides in the ContextAssetRequestHandler class and results from improper filtering of HTTP requests, allowing specially-constructed URLs to bypass access controls [2]. This was caused by an incomplete fix for CVE-2020-13953 [1]. Affected versions are Apache Tapestry 5.4.0 up to and including 5.6.3, as well as 5.7.0 and 5.7.1 [1][2][3].

Exploitation

No authentication is required [2]. An attacker on the network can construct a malicious URL that exploits the improper input validation [3]. The vulnerability can be triggered remotely without user interaction [2]. By sending such a request, the attacker can download files located inside the WEB-INF directory of the application [1][2].

Impact

Successful exploitation leads to disclosure of sensitive information, as files within WEB-INF may contain configuration data, credentials, or source code [2]. The information disclosure occurs in the context of the SYSTEM level, meaning the attacker gains access to files normally protected from direct access [2]. The confidentiality impact is high, while integrity and availability are not affected [2].

Mitigation

Apache released fixed versions: upgrade to 5.6.4 for the 5.4.x–5.6.x branch, or 5.7.2 for the 5.7.x branch [3]. No workaround has been provided in the available references. The vulnerability is not listed on CISA’s Known Exploited Vulnerabilities (KEV) catalog.