CVE-2021-30638: 
Java vulnerability analysis and mitigation

Information Exposure vulnerability (CVE-2021-30638) was discovered in Apache Tapestry's context asset handling, affecting versions from 5.4.0 to 5.6.3 and versions 5.7.0 to 5.7.1. The vulnerability, discovered by Kc Udonsi of Trend Micro, was caused by an incomplete fix for CVE-2020-13953 (ZDI Advisory, Apache Advisory).

The vulnerability exists within the ContextAssetRequestHandler class and results from improper filtering of HTTP requests. The recent patch for CVE-2020-13953 failed to account for the backslash character in the filtering regex, allowing attackers to bypass security controls. The vulnerability has a CVSS v3.1 base score of 7.5 (HIGH) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (ZDI Advisory).

When successfully exploited, this vulnerability allows remote attackers to download files inside the WEB-INF and META-INF directories using specially-constructed URLs. The attacker can leverage this vulnerability to disclose sensitive information in the context of SYSTEM without requiring authentication (ZDI Advisory).

The vulnerability can be exploited remotely without requiring authentication or user interaction. An attacker can use specially-crafted URLs to list and download web app files from the WEB-INF and META-INF directories (OSS Security).

Users are advised to upgrade to patched versions: For Tapestry 5.4.0 to 5.6.3, upgrade to version 5.6.4; For Tapestry 5.7.0 and 5.7.1, upgrade to version 5.7.2 (OSS Security).