Apache Tapestry ClasspathAssetRequestHandler Information Disclosure Vulnerability

This strike exploits an information disclosure vulnerability in Apache Tapestry. The vulnerability resides in the ClasspathAssetRequestHandler class, specifically in the handleAssetRequest() function, due to improper validation of user input and URL manipulation. A remote, unauthenticated attacker can exploit this flaw by sending a crafted HTTP request, potentially leading to the exposure of sensitive files such as application classes, XML, and property files, which could further enable remote code execution.