Apache Tapestry prior to version 4 (EOL) allows RCE though deserialization of untrusted input

Vulnerability

Overview

CVE-2022-46366 is an unsafe deserialization vulnerability in Apache Tapestry version line 3.x. The root cause is that the framework deserializes untrusted data supplied by end-users, specifically through the sp parameter, without proper validation. This issue is similar to CVE-2020-17531, which affects the separate 4.x version line, but requires different modifications to the payload for successful exploitation [1][3].

Exploitation

Details

The vulnerability can be exploited by an unauthenticated attacker who sends a crafted Java serialized object via the sp parameter. Although automated scanners may not identify the issue due to the need for source code analysis to determine the correct payload structure, the attack surface is accessible remotely over the network. The affected component is the Tapestry framework itself, which processes the malicious input during deserialization [3].

Impact

Successful exploitation leads to arbitrary code execution on the underlying server, allowing an attacker to completely compromise the application and its host system. The impact is rated as very high, as the attacker gains full control of the server [3].

Mitigation

Status

Apache Tapestry 3.x is end-of-life (EOL) and no longer supported by the maintainer. As a result, no patch will be released for this vulnerability. Users are strongly recommended to upgrade to a supported version line of Apache Tapestry to remediate the risk [2][3].