Date: Tue, 27 Apr 2021 14:35:20 -0300 From: "Thiago H. de Paula Figueiredo" <thiagohp@...il.com> To: oss-security@...ts.openwall.com Subject: CVE-2021-30638: An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.4.0 and later Description: Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1. Solution: For Tapestry 5.4.0 to 5.6.3: upgrade to 5.6.4 For Tapestry 5.7.0 and 5.7.1: upgrade to 5.7.2 ************ Problem Description ************ An Information Disclosure due to insufficient input validation exists in Apache Tapestry 5.6.1 and later (latest) A recent patch for CVE-2020-13953 ( https://github.com/apache/tapestry-5/commit/cf1912291af9146ee86a4aef471ae2ab31d3a28b ) fails to account for the backslash character in the filtering regex An attacker is therefore able to list and download web app files from the WEB-INF and META-INF directory using a crafted payload. Credit: This vulnerability was discovered by Kc Udonsi of Trend Micro -- Thiago
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.