CVE-2021-28163: Directory exposure in jetty
Summary
CVE-2021-28163: Directory exposure in jetty. Affects org.eclipse.jetty:jetty-deploy across 3 version ranges.
>= 9.4.32, < 9.4.39
>= 10.0.0, < 10.0.2
>= 11.0.0, < 11.0.2
Fixed in 9.4.39, 10.0.2 or 11.0.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2021-28163 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The impacted package is org.eclipse.jetty:jetty-deploy, which is a component of the Jetty web server. Jetty is a Java-based HTTP server and servlet container that is widely used for hosting web applications. The jetty-deploy package provides functionality for deploying web applications in Jetty. This vulnerability affects versions 9.4.32 to 9.4.39, 10.0.0 to 10.0.2, and 11.0.0 to 11.0.2 of the package.
Vulnerability Detail
The vulnerability allows an attacker to expose the contents of the ${jetty.base}/webapps directory if it is a symlink (soft link) in Linux. This means that the directory's contents may be deployed as a static web application, making them accessible for download. The issue arises when the ${jetty.base} directory structure includes a symlink to the ${jetty.base}/webapps directory. For example, if the ${jetty.base} directory contains a symlink named 'webapps' that points to the 'deploy' directory, the contents of the 'deploy' directory will be exposed as a web application. This can lead to unauthorized access to sensitive information or source code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.4.32, < 9.4.399.4.39 -
>= 10.0.0, < 10.0.210.0.2 -
>= 11.0.0, < 11.0.211.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended fix is to avoid using symlinks.
Conclusion
The vulnerability in the org.eclipse.jetty:jetty-deploy package allows an attacker to expose the contents of the ${jetty.base}/webapps directory, potentially leading to unauthorized access to sensitive information or source code. To fix this vulnerability, it is advised to avoid using symlinks in the affected directories. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-deploy →
FAQ
The vulnerability allows an attacker to access and download the contents of the ${jetty.base}/webapps directory, potentially exposing sensitive information or source code.
Versions 9.4.32 to 9.4.39, 10.0.0 to 10.0.2, and 11.0.0 to 11.0.2 of the package are affected.
The CVSS score of this vulnerability is 2.7, indicating a low severity.
There is no known exploit for this vulnerability at the moment.
The recommended mitigation is to avoid using symlinks in the affected directories.
