CVE-2023-40167: Jetty Accepts '+' Prefixed Value in Content-Length
Summary
CVE-2023-40167: Jetty accepts "+" prefixed value in Content-Length. Affects org.eclipse.jetty:jetty-http across 4 version ranges.
>= 9.0.0, < 9.4.52
>= 10.0.0, < 10.0.16
>= 11.0.0, < 11.0.16
>= 12.0.0, < 12.0.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- jetty9 · Debian:11
The same CVE-2023-40167 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jetty is an open-source HTTP server and servlet container developed by the Eclipse Foundation. It provides a Java-based implementation of the HTTP protocol and is widely used in web application development. The 'org.eclipse.jetty:jetty-http' package is responsible for handling HTTP requests and responses. However, a vulnerability has been discovered in Jetty's handling of the Content-Length header, which could potentially lead to HTTP request smuggling.
Vulnerability Detail
The vulnerability in Jetty arises from its acceptance of the '+' character preceding the content-length value in an HTTP/1 header field. This behavior is more permissive than what is allowed by the RFC, and other servers typically reject such requests with a 400 Bad Request response. While there is no known exploit scenario, it is conceivable that request smuggling could occur if Jetty is used in combination with a server that does not close the connection after sending a 400 response. This vulnerability has a CVSS score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 9.4.529.4.52 -
>= 10.0.0, < 10.0.1610.0.16 -
>= 11.0.0, < 11.0.1611.0.16 -
>= 12.0.0, < 12.0.112.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability as there is no known exploit scenario.
Conclusion
In conclusion, the Jetty server's acceptance of the '+' character preceding the content-length value in an HTTP/1 header field poses a potential vulnerability for request smuggling. It is important to upgrade to the fixed versions of the 'org.eclipse.jetty:jetty-http' package to mitigate this issue. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-http →
FAQ
Jetty is an open-source HTTP server and servlet container developed by the Eclipse Foundation. It provides a Java-based implementation of the HTTP protocol.
The 'org.eclipse.jetty:jetty-http' package is responsible for handling HTTP requests and responses in Jetty.
The impact of this vulnerability is that Jetty accepts the '+' character preceding the content-length value in an HTTP/1 header field, which is more permissive than allowed by the RFC. While there is no known exploit scenario, it could potentially lead to request smuggling if used in combination with a server that does not close the connection after sending a 400 response.
To fix this vulnerability, it is recommended to upgrade to the fixed versions of the 'org.eclipse.jetty:jetty-http' package. Please refer to the 'how_to_fix' section for the specific version numbers.
No, there is no known workaround for this vulnerability as there is no known exploit scenario.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-http.
