CVE-2021-34429: Encoded URIs can access WEB-INF directory in Eclipse Jetty
Summary
CVE-2021-34429: Encoded URIs can access WEB-INF directory in Eclipse Jetty. Affects org.eclipse.jetty:jetty-webapp across 3 version ranges.
>= 9.4.37, < 9.4.43
>= 10.0.1, < 10.0.6
>= 11.0.1, < 11.0.6
Fixed in 9.4.43, 10.0.6 or 11.0.6, depending on the release line you run. How to fix ↓
Also tracked for
- jetty9 · Debian:11
The same CVE-2021-34429 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.eclipse.jetty:jetty-webapp package is an open-source Java web server and servlet container. It provides support for deploying web applications and serving HTTP requests. The package is widely used in various Java-based web applications and frameworks.
Vulnerability Detail
URIs can be crafted using encoded characters to access the content of the WEB-INF directory and bypass security constraints in Eclipse Jetty. This vulnerability allows an attacker to retrieve sensitive information about the implementation of a web application. The default compliance mode in Jetty allows requests with URIs containing %u002e segments to access protected resources within the WEB-INF directory. Additionally, an encoded null character can prevent correct normalization, allowing the retrieval of the web.xml file. This vulnerability is a variation of the previously reported CVE-2021-28164/GHSA-v7ff-8wcx-gmc5 vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.4.37, < 9.4.439.4.43 -
>= 10.0.1, < 10.0.610.0.6 -
>= 11.0.1, < 11.0.611.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A workaround for this vulnerability is to deploy Jetty rewrite rules that rewrite any request containing encoded dot segments or null characters in the raw request URI to a known not found resource. Here is an example of the rewrite rules:
<Call name="addRule">
<Arg>
<New class="org.eclipse.jetty.rewrite.handler.RewriteRegexRule">
<Set name="regex">.*/(?:\.+/)+.*</Set>
<Set name="replacement">/WEB-INF/Not-Found</Set>
</New>
</Arg>
</Call>
<Call name="addRule">
<Arg>
<New class="org.eclipse.jetty.rewrite.handler.ValidUrlRule"/>
</Arg>
</Call>
These rules will rewrite any request with encoded dot segments or null characters in the URI to the /WEB-INF/Not-Found resource, preventing access to protected resources.
Conclusion
The CVE-2021-34429 vulnerability in the org.eclipse.jetty:jetty-webapp package allows attackers to access protected resources within the WEB-INF directory and retrieve sensitive information about a web application's implementation. Upgrading to the latest version of Jetty (9.4.43, 10.0.6, or 11.0.6) or applying the provided workaround will mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-webapp →
FAQ
The vulnerability allows an attacker to access the content of the WEB-INF directory and retrieve sensitive information about the implementation of a web application. This can potentially expose security vulnerabilities and aid in further attacks.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
Yes, a workaround for this vulnerability is to deploy Jetty rewrite rules that rewrite requests with encoded dot segments or null characters in the URI to a known not found resource. The provided example rewrite rules can be used as a starting point.
The recommended fix is to upgrade to the latest version of the org.eclipse.jetty:jetty-webapp package (9.4.43, 10.0.6, or 11.0.6). These releases include fixes that restore several lines of defense against URI alias attacks and ensure proper decoding and normalization of URIs.
You can find more information about this vulnerability in the GitHub Security Advisory GHSA-vjv5-gp2w-65vm at https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-webapp.
