Connexion Inscription
JA · EN · FR
SecPulse
Catégories
CVE-2021-34429

Encoded URIs can access WEB-INF directory in Eclipse Jetty

Résumé

Encoded URIs can access WEB-INF directory in Eclipse Jetty

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Description

URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints.
This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Impact

The default compliance mode allows requests with URIs that contain a %u002e segment to access protected resources within the WEB-INF directory. For example, a request to /%u002e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Similarly, an encoded null character can prevent correct normalization so that /.%00/WEB-INF/web.xml cal also retrieve the web.xml file.

Workarounds

Some Jetty rewrite rules can be deployed to rewrite any request containing encoded dot segments or null characters in the raw request URI, to a known not found resource:


  
    
      .*/(?:\.+/)+.*
      /WEB-INF/Not-Found

Analysis

Prior to 9.4.37, Jetty was protected from this style of attack by two lines of defense:

  • URIs were decoded first and then normalized for . and .. sequences. Whilst this is not according to the RFC, it did remove relative segments that were encoded or parameterized and made the…

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Paquets affectés

Maven org.eclipse.jetty:jetty-webapp
[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.1"},{"fixed":"11.0.6"}]}]

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Références

Nous utilisons des cookies pour l'analyse d'audience et la mesure publicitaire. Ce réglage s'applique à tous les sites de Game co., Ltd. En savoir plus