CVE-2016-4800: Jetty Server Alias Issue Allows Remote Code Execution
Summary
CVE-2016-4800: The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certai... Affects org.eclipse.jetty:jetty-server versions >= 9.3.0, < 9.3.9. Fixed in 9.3.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jetty Server is a popular Java-based web server and servlet container. It provides a lightweight and efficient platform for hosting web applications. The server is widely used in various industries and is known for its performance and scalability. However, a vulnerability has been discovered in Jetty Server versions 9.3.x before 9.3.9 on Windows, which allows remote attackers to bypass protected resource restrictions and execute arbitrary code.
Vulnerability Detail
The vulnerability in Jetty Server is due to an alias issue in the PathResource class. The path normalization mechanism in this class fails to properly handle certain escaped characters in a URL, specifically backslashes. This flaw can be exploited by an attacker to bypass security constraints and gain unauthorized access to protected resources. By crafting a specially crafted request, an unauthenticated remote attacker can execute arbitrary code on the target system, potentially leading to a complete compromise of the server.
How To Fix
Minimum fixed version
9.3.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to a fixed version of Jetty Server to address the issue.
Conclusion
The Jetty Server alias issue is a critical vulnerability that allows unauthenticated remote code execution. It is crucial for users to upgrade to Jetty Server version 9.3.9 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
The vulnerability allows unauthenticated remote attackers to execute arbitrary code on the target system, potentially leading to a complete compromise of the server.
Jetty Server versions 9.3.x before 9.3.9 on Windows are affected by this vulnerability.
No, this vulnerability can be exploited by unauthenticated remote attackers.
No, there are no known workarounds for this vulnerability. It is recommended to apply the official patch or upgrade to a fixed version.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this Jetty Server vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
