CVE-2009-4611: Improper input validation in Mort Bay Jetty
Summary
CVE-2009-4611: Improper input validation in Mort Bay Jetty. Affects org.mortbay.jetty:jetty across 2 version ranges.
>= 6.0.0, < 6.1.23
>= 7.0.0, < 7.0.2
Fixed in 6.1.23 or 7.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mort Bay Jetty is a web server and servlet container that is widely used in Java applications. It provides a lightweight and scalable solution for serving web content. The vulnerability identified as CVE-2009-4611 affects versions 6.x through 6.1.22 and 7.0.0 of Mort Bay Jetty. This vulnerability arises from the improper input validation performed by the server, which allows remote attackers to manipulate window titles, execute arbitrary commands, or overwrite files through specially crafted HTTP requests. The vulnerability is related to the handling of non-printable characters and escape sequences for terminal emulators.
Vulnerability Detail
The vulnerability in Mort Bay Jetty allows remote attackers to exploit the server's improper input validation. By including escape sequences or non-printable characters in specific parameters or headers of an HTTP request, an attacker can modify the window title of a user's terminal emulator, potentially tricking the user into executing unintended commands or overwriting files. The affected parameters include the 'Age' parameter in the default URI for the Cookie Dump Servlet, the 'A' parameter in 'jsp/expr.jsp', and the 'Content-Length' HTTP header in any application. This vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0.0, < 6.1.236.1.23 -
>= 7.0.0, < 7.0.27.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can implement input validation and sanitization mechanisms in their applications to filter out escape sequences and non-printable characters from user-supplied input. Additionally, it is advisable to restrict access to the affected server and closely monitor incoming HTTP requests for any suspicious activity.
Conclusion
The vulnerability in Mort Bay Jetty poses a significant risk to the security and stability of affected systems. It is crucial for developers and system administrators to promptly apply the recommended fixes or workarounds to mitigate the potential impact. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for org.mortbay.jetty:jetty →
FAQ
Mort Bay Jetty is a popular web server and servlet container used in Java applications. It provides a lightweight and scalable solution for serving web content.
This vulnerability allows remote attackers to manipulate window titles, execute arbitrary commands, or overwrite files by exploiting the server's improper input validation.
The consequences of this vulnerability include unauthorized command execution, file manipulation, and potential compromise of the affected system's confidentiality, integrity, and availability.
To fix this vulnerability, it is recommended to upgrade Mort Bay Jetty to the latest secure version or consider migrating to an alternative web server or servlet container.
As a temporary workaround, developers can implement input validation and sanitization mechanisms in their applications and closely monitor incoming HTTP requests for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for org.mortbay.jetty:jetty.
