Package Instance

Deserialization of Untrusted Data
A critical unauthenticated remote code execution vulnerability was found in Apache Tapestry.

Path Traversal
Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which does not filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.

Deserialization of Untrusted Data
A Java Serialization vulnerability was found in Apache Tapestry Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.

Files or Directories Accessible to External Parties
In Apache Tapestry, crafting specific URLs, an attacker can download files inside the WEB-INF folder of the WAR being run.

Improper Input Validation
The code which checks HMAC in form submissions used `String.equals()` for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.

Deserialization of Untrusted Data
Manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the `tapestry.hmac-passphrase` configuration symbol, most probably the webapp's AppModule class, the value of this symbol could be used to craft a Java deserialization attack, thus running malicious injected Java code. The vector would be the `t:formdata` parameter from the Form component.