CVE-2021-28164: Authorization Before Parsing and Canonicalization in jetty-webapp
Summary
CVE-2021-28164: Authorization Before Parsing and Canonicalization in jetty. Affects org.eclipse.jetty:jetty-webapp versions >= 9.4.37, < 9.4.39. Fixed in 9.4.39. How to fix ↓
Also tracked for
- jetty9 · Debian:11
The same CVE-2021-28164 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The jetty-webapp package is a part of the Jetty web server and servlet container. It provides support for deploying web applications in a Jetty server. The package allows developers to create and manage web applications using Java servlets and other web technologies. However, a vulnerability has been discovered in versions 9.4.37 to 9.4.39 of the jetty-webapp package.
Vulnerability Detail
The vulnerability (CVE-2021-28164) arises from a more precise implementation of RFC3986 with regards to URI decoding introduced in version 9.4.37 of jetty-webapp. By default, the package allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. This can lead to the disclosure of sensitive information about the web application's implementation. An attacker could exploit this vulnerability to retrieve files such as web.xml, potentially exposing configuration details and other sensitive data.
How To Fix
Minimum fixed version
9.4.39
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a workaround can be implemented by enabling the RFC7230_NO_AMBIGUOUS_URIS compliance mode. This can be done by updating the start.d/http.ini file and adding the following line:
jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS
Enabling this compliance mode ensures that requests with ambiguous URIs are not allowed to access protected resources.
Conclusion
The jetty-webapp package versions 9.4.37 to 9.4.39 are vulnerable to CVE-2021-28164, which allows unauthorized access to protected resources within the WEB-INF directory. It is crucial to update the package to version 9.4.39 or later to fix the vulnerability. Alternatively, the RFC7230_NO_AMBIGUOUS_URIS compliance mode can be enabled as a temporary workaround. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-webapp →
FAQ
The vulnerability allows unauthorized access to protected resources within the WEB-INF directory, potentially exposing sensitive information about the web application's implementation.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.
Yes, a fix is available in version 9.4.39 of the jetty-webapp package. It is recommended to update to this version or later to mitigate the vulnerability.
Yes, if updating the package is not immediately feasible, you can enable the RFC7230_NO_AMBIGUOUS_URIS compliance mode as a workaround. Please refer to the 'workaround' section for instructions on how to enable this mode.
There are no known instances of this vulnerability being exploited in the wild. However, it is important to promptly update the package or implement the recommended workaround to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-webapp.
