{"vulnerability": "cve-2021-27850", "sightings": [{"uuid": "5d90efe6-2459-4486-a9f0-0d4fc2f0da94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-27850.yaml", "content": "", "creation_timestamp": "2023-04-27T09:58:59.000000Z"}, {"uuid": "6151bf75-698c-4250-9b36-2b48532c19e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "MISP/6a1f16d1-c421-4630-8ee9-fdd9660cff11", "content": "", "creation_timestamp": "2024-11-14T06:09:32.000000Z"}, {"uuid": "2724ece1-3255-42a1-a1dd-fa2144611af3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-02-03)", "content": "", "creation_timestamp": "2025-02-03T00:00:00.000000Z"}, {"uuid": "5889ec79-f5c8-4a3b-b02b-3c667555b218", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-01-30)", "content": "", "creation_timestamp": "2025-01-30T00:00:00.000000Z"}, {"uuid": "7819abcd-ae6a-492c-8adf-71d0b2c09f57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "789d1ff7-f889-4899-ad08-8ecf2fac7dee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2025-01-26)", "content": "", "creation_timestamp": "2025-01-26T00:00:00.000000Z"}, {"uuid": "fb25cb88-cd7a-4464-958d-8b76105771a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:36.000000Z"}, {"uuid": "aefe01d5-eb84-4e41-8276-842772bbc14a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-03-18)", "content": "", "creation_timestamp": "2025-03-18T00:00:00.000000Z"}, {"uuid": "11db9cf3-fef5-4205-8291-aa2c36db862e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-11)", "content": "", "creation_timestamp": "2025-06-11T00:00:00.000000Z"}, {"uuid": "b66ca51a-68f4-425d-9bd8-ad1a2ab75d53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-04-28)", "content": "", "creation_timestamp": "2025-04-28T00:00:00.000000Z"}, {"uuid": "f62ae3bb-e4e5-4113-b252-ea0ba1cde810", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-06-23)", "content": "", "creation_timestamp": "2025-06-23T00:00:00.000000Z"}, {"uuid": "2fad3752-9d40-4649-9e94-5013227fdf56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-05-22)", "content": "", "creation_timestamp": "2025-05-22T00:00:00.000000Z"}, {"uuid": "74944d92-ba66-4ffa-bd80-8b15bfa5e3fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-11-28)", "content": "", "creation_timestamp": "2025-11-28T00:00:00.000000Z"}, {"uuid": "983ec7f9-5531-4535-b0c6-41b3755849b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/cve_2021_27850_apache_tapestry_hmac_key.rb", "content": "", "creation_timestamp": "2021-07-22T18:06:20.000000Z"}, {"uuid": "a07b2514-74ac-42d2-a5e5-7986795952ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-05)", "content": "", "creation_timestamp": "2025-12-05T00:00:00.000000Z"}, {"uuid": "4df4ef31-9aa2-436c-b1c5-d70e0a9c3e06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-09)", "content": "", "creation_timestamp": "2025-12-09T00:00:00.000000Z"}, {"uuid": "27548d73-9090-4f3e-a2f9-8cbbe626769d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-01)", "content": "", "creation_timestamp": "2026-03-01T00:00:00.000000Z"}, {"uuid": "9f6e0da5-96c2-43fc-b278-40b0af182775", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-14)", "content": "", "creation_timestamp": "2025-12-14T00:00:00.000000Z"}, {"uuid": "6e637480-1cf1-4e98-bf81-d0db8ed711da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-15)", "content": "", "creation_timestamp": "2025-12-15T00:00:00.000000Z"}, {"uuid": "6fa5ed46-d6cc-4ca1-8418-c5cf90a65cff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-20)", "content": "", "creation_timestamp": "2025-12-20T00:00:00.000000Z"}, {"uuid": "13735ee2-cf19-43c3-8efc-8a6199aa653d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-28)", "content": "", "creation_timestamp": "2026-01-28T00:00:00.000000Z"}, {"uuid": "01dc0a84-161f-4e95-b560-fa792438adf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-02-11)", "content": "", "creation_timestamp": "2026-02-11T00:00:00.000000Z"}, {"uuid": "190391ea-4fe5-46aa-927e-3e3261c58b53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2025-12-31)", "content": "", "creation_timestamp": "2025-12-31T00:00:00.000000Z"}, {"uuid": "db57466a-3cca-455f-97d4-251923789a3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-01-10)", "content": "", "creation_timestamp": "2026-01-10T00:00:00.000000Z"}, {"uuid": "0af124bc-9221-4150-96af-faf4c90e3aa3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-03-22)", "content": "", "creation_timestamp": "2026-03-22T00:00:00.000000Z"}, {"uuid": "2adde53a-5fe6-4130-8141-c93d4b1a954a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/92582bf5-d92c-47fe-b891-656d271bbfef", "content": "", "creation_timestamp": "2024-10-14T15:50:35.983245Z"}, {"uuid": "335e4d23-fec6-49f8-b01a-82d39dc19ed4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "published-proof-of-concept", "source": "https://t.me/arpsyndicate/228", "content": "#ExploitObserverAlert\n\nCVE-2021-27850\n\nDESCRIPTION: Exploit Observer has 14 entries related to CVE-2021-27850. A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.\n\nFIRST-EPSS: 0.974140000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2023-11-17T07:08:00.000000Z"}, {"uuid": "868152d7-9710-4465-ab87-2edc7fc7432d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/712", "content": "CVE-2021-27850 Apache Tapestry\u9060\u7a0b\u57f7\u884c\u4ee3\u78bc\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2021-27850_Apache_Tapestry%E9%81%A0%E7%A8%8B%E5%9F%B7%E8%A1%8C%E4%BB%A3%E7%A2%BC%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T04:42:22.000000Z"}, {"uuid": "69859d12-8849-48a9-8a85-7de4a656bf85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "published-proof-of-concept", "source": "https://t.me/HackerOne/3102", "content": "CVE-2021-27850 Exploit\nhttps://github.com/kahla-sec/CVE-2021-27850_POC", "creation_timestamp": "2021-07-27T21:50:47.000000Z"}, {"uuid": "d9e8aec0-644f-49d3-9ec0-1c5a1fbb3835", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "published-proof-of-concept", "source": "https://t.me/canyoupwnme/6744", "content": "CVE-2021-27850 Exploit\nhttps://github.com/kahla-sec/CVE-2021-27850_POC", "creation_timestamp": "2021-06-29T17:44:18.000000Z"}, {"uuid": "96e91f2b-f48c-4a92-bd2e-333e2b07f4da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3694", "content": "#exploit\nA PoC for CVE-2021-27850\naffecting Apache Tapestry and leading to unauthencticated RCE\nhttps://github.com/kahla-sec/CVE-2021-27850_POC", "creation_timestamp": "2021-06-26T13:47:51.000000Z"}, {"uuid": "1514445d-f3bc-4e6b-ac8e-d6a6d9117c28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3732", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (June 1-30)\nCVE-2021-1675 - Windows Print Spooler EoP\nhttps://t.me/cybersecuritytechnologies/3723\nCVE-2021-21985 - vSphere Client RCE\nhttps://t.me/cybersecuritytechnologies/3493\nCVE-2021-3560 - Privilege escalation with polkit\nhttps://t.me/cybersecuritytechnologies/3587\nCVE-2021-28476 - Hyper-V RCE in vmswitch.sys\nhttps://t.me/cybersecuritytechnologies/3514\nCVE-2020-3580 - XSS in Cisco ASA\nhttps://www.helpnetsecurity.com/2021/06/29/cve-2020-3580-exploit\nCVE-2021-31955/31956 - Windows NTFS EoP/Kernel Information Disclosure\nhttps://github.com/mavillon1/CVE-2021-31955-POC\nhttps://t.me/cybersecuritytechnologies/3705\nCVE-2021-33739 - MS DWM Core Library EoP\nhttps://t.me/cybersecuritytechnologies/3581\nCVE-2021-27850 - Apache Tapestry RCE\nhttps://t.me/cybersecuritytechnologies/3694\nCVE-2020-36289 - Atlassian Jira Unauth User Enum\nhttps://mobile.twitter.com/i/web/status/1402644004781633540", "creation_timestamp": "2021-07-01T11:03:01.000000Z"}, {"uuid": "8c88d7b1-a570-4de4-a1c4-2f9f8592d9fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "published-proof-of-concept", "source": "https://t.me/club31337/481", "content": "https://github.com/kahla-sec/CVE-2021-27850_POC", "creation_timestamp": "2024-11-09T01:33:49.000000Z"}, {"uuid": "a9938d40-c16c-4d1b-9dd3-ffd1d3d1d7eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "Telegram/23aKnIFlZBB8r0V68doIAMfGKCLJusz1ZVEh5vrmpx1x9Pc", "content": "", "creation_timestamp": "2026-09-02T01:00:17.238116Z"}, {"uuid": "bdb7a70e-4f66-46d7-a16f-412f0cb35815", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/4b88f874-9ed8-4046-af05-6923d69e8e6e", "content": "", "creation_timestamp": "2026-06-19T12:46:17.890763Z"}, {"uuid": "7885032e-e71b-4ed8-8256-841ff1963ed1", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f0da9e81-d45f-4f65-be6a-fd4af53b9c04", "content": "", "creation_timestamp": "2026-06-23T14:04:25.583440Z"}, {"uuid": "95cd343c-2412-4c69-9501-a72af30657db", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/db98cb31-36f0-4d78-9ea0-7ccabb3bbf8c", "content": "", "creation_timestamp": "2026-06-30T09:22:49.959186Z"}, {"uuid": "ba59d1d8-4e14-48ed-af08-601d25920008", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-07-16)", "content": "", "creation_timestamp": "2026-07-17T10:15:07.855671Z"}, {"uuid": "fc216869-1c6e-459b-b060-cdc9b02fffd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "https://t.me/cissp/3562", "content": "exploit\nA PoC for CVE-2021-27850\naffecting Apache Tapestry and leading to unauthencticated RCE\nhttps://github.com/kahla-sec/CVE-2021-27850_POC\n\nThreat Research\nMultiple pre-auth RCEs in Apache Dubbo - CVE-2021-25641, CVE-2021-30179, CVE-2021-30180, CVE-2021-30181, CVE-2021-32824\nhttps://securitylab.github.com/advisories/GHSL-2021-034_043-apache-dubbo\n\nA step-by-step tutorial for Soot\n(A Java static analysis framework)\nhttps://github.com/noidsirius/SootTutorial\n\nMalware analysis\n1. iOS Malicious Bit Hunter - malicious plug-in detection engine for iOS applications\ud83d\udc4d\ud83c\udffd\nhttps://github.com/alipay/ios-malicious-bithunter\n2. Crackonosh: A New Malware Distributed in Cracked Software\nhttps://decoded.avast.io/danielbenes/crackonosh-a-new-malware-distributed-in-cracked-software", "creation_timestamp": "2026-09-01T17:00:47.094867Z"}, {"uuid": "5bacb73e-3991-4872-be02-1f20aeb816e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "https://t.me/hacking_Attack/15675", "content": "Exploit Collector\nCVE-2021-27850_POC - A Proof Of Concept For CVE-2021-27850 Affecting Apache Tapestry And Leading To Unauthencticated Remote Code Execution\n\nCVE-2021-27850 is a critical unauthenticated remote code execution vulnerability that was found in all recent versions of Apache Tapestry, by downloading the AppModule.class file we can leak the HMAC Secret key used to sign all the serialized objects in apache Tapestry.\n\nWe encountered this CVE in a real life assessment and as far as I know there are no public exploits available on how Tapestry signs the serialized objects so we decided to publish the following POC that we have used after digging in apache Tapestry source code for a long time x) .\n\nKudos to my senpai Fares\n\nUsage\n\n1- Clone this repo\n\n2- Run the following command\n\njavac -classpath commons-codec-1.15/commons-codec-1.15.jar:. Exploit.java\n\n3- Finally run the following:\n\njava -cp commons-codec-1.15/commons-codec-1.15.jar:. Exploit [Tapestry Key] [Ysoserial Payload] [Command To Execute]\n\nWhere [Tapestry Key] is the Hmac key leaked from the AppModule.class , [Ysoserial Payload] is the payload you want to use from ysoserial and [Command To Execute] the command you want to execute.\n\nhttp://3.bp.blogspot.com/-oT248hEmxFM/YORrwT4fnII/AAAAAAAAhI4/9vcZt2QOJRIVD3QS0OlL6azyCHQtVGauACK4BGAYYCw/w640-h52/CVE-2021-27850_POC_1-724289.png \n\nNote: Unlike the usual Java deserialization exploits where the commands you run are limited ( no pipes or special chars .. ) you can use here any complex command you want since we are appending the following before executing the command sh -c $@|sh . echo.\n\nReferences:\n\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-27850\n\nhttps://github.com/apache/tapestry-5\nDownload CVE-2021-27850_POC", "creation_timestamp": "2026-09-01T20:02:33.817993Z"}, {"uuid": "0b06505a-1e19-43b8-8ccc-9cff01fa526e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "published-proof-of-concept", "source": "Telegram/5XKanLqzndKTp87szQTPMzuzxyafZxrYjGI4eXPkJHPBONs", "content": "", "creation_timestamp": "2026-09-02T01:00:04.128274Z"}, {"uuid": "ee0430b0-4dc8-434f-8fc1-73141b698bde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "https://t.me/hacking_Attack/15675", "content": "Exploit Collector\nCVE-2021-27850_POC - A Proof Of Concept For CVE-2021-27850 Affecting Apache Tapestry And Leading To Unauthencticated Remote Code Execution\n\nCVE-2021-27850 is a critical unauthenticated remote code execution vulnerability that was found in all recent versions of Apache Tapestry, by downloading the AppModule.class file we can leak the HMAC Secret key used to sign all the serialized objects in apache Tapestry.\n\nWe encountered this CVE in a real life assessment and as far as I know there are no public exploits available on how Tapestry signs the serialized objects so we decided to publish the following POC that we have used after digging in apache Tapestry source code for a long time x) .\n\nKudos to my senpai Fares\n\nUsage\n\n1- Clone this repo\n\n2- Run the following command\n\njavac -classpath commons-codec-1.15/commons-codec-1.15.jar:. Exploit.java\n\n3- Finally run the following:\n\njava -cp commons-codec-1.15/commons-codec-1.15.jar:. Exploit [Tapestry Key] [Ysoserial Payload] [Command To Execute]\n\nWhere [Tapestry Key] is the Hmac key leaked from the AppModule.class , [Ysoserial Payload] is the payload you want to use from ysoserial and [Command To Execute] the command you want to execute.\n\nhttp://3.bp.blogspot.com/-oT248hEmxFM/YORrwT4fnII/AAAAAAAAhI4/9vcZt2QOJRIVD3QS0OlL6azyCHQtVGauACK4BGAYYCw/w640-h52/CVE-2021-27850_POC_1-724289.png \n\nNote: Unlike the usual Java deserialization exploits where the commands you run are limited ( no pipes or special chars .. ) you can use here any complex command you want since we are appending the following before executing the command sh -c $@|sh . echo.\n\nReferences:\n\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-27850\n\nhttps://github.com/apache/tapestry-5\nDownload CVE-2021-27850_POC", "creation_timestamp": "2026-09-02T01:03:07.810983Z"}, {"uuid": "7a77f551-7eb9-4f8b-a8e6-6faf58b5e88f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-27850", "type": "seen", "source": "https://t.me/cissp/3562", "content": "exploit\nA PoC for CVE-2021-27850\naffecting Apache Tapestry and leading to unauthencticated RCE\nhttps://github.com/kahla-sec/CVE-2021-27850_POC\n\nThreat Research\nMultiple pre-auth RCEs in Apache Dubbo - CVE-2021-25641, CVE-2021-30179, CVE-2021-30180, CVE-2021-30181, CVE-2021-32824\nhttps://securitylab.github.com/advisories/GHSL-2021-034_043-apache-dubbo\n\nA step-by-step tutorial for Soot\n(A Java static analysis framework)\nhttps://github.com/noidsirius/SootTutorial\n\nMalware analysis\n1. iOS Malicious Bit Hunter - malicious plug-in detection engine for iOS applications\ud83d\udc4d\ud83c\udffd\nhttps://github.com/alipay/ios-malicious-bithunter\n2. Crackonosh: A New Malware Distributed in Cracked Software\nhttps://decoded.avast.io/danielbenes/crackonosh-a-new-malware-distributed-in-cracked-software", "creation_timestamp": "2026-09-02T01:04:34.740407Z"}]}