Sign in Sign up
JA · EN · FR
SecPulse
Categories
CVE-2021-34429

Encoded URIs can access WEB-INF directory in Eclipse Jetty

Summary

Encoded URIs can access WEB-INF directory in Eclipse Jetty

Original description

The description as published by the source.

Description

URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints.
This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Impact

The default compliance mode allows requests with URIs that contain a %u002e segment to access protected resources within the WEB-INF directory. For example, a request to /%u002e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Similarly, an encoded null character can prevent correct normalization so that /.%00/WEB-INF/web.xml cal also retrieve the web.xml file.

Workarounds

Some Jetty rewrite rules can be deployed to rewrite any request containing encoded dot segments or null characters in the raw request URI, to a known not found resource:


  
    
      .*/(?:\.+/)+.*
      /WEB-INF/Not-Found

Analysis

Prior to 9.4.37, Jetty was protected from this style of attack by two lines of defense:

  • URIs were decoded first and then normalized for . and .. sequences. Whilst this is not according to the RFC, it did remove relative segments that were encoded or parameterized and made the…

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Maven org.eclipse.jetty:jetty-webapp
[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.1"},{"fixed":"11.0.6"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

References

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details