Lucene search

K
githubGitHub Advisory DatabaseGHSA-P26G-97M4-6Q7C
HistoryApr 18, 2023 - 10:19 p.m.

Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies

2023-04-1822:19:57
CWE-200
GitHub Advisory Database
github.com
14
eclipse jetty
cookie parsing
security implications
httponly cookie
pr #9352
pr #9339
pr #9339
rfc 2965
rfc 6265

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

40.9%

Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism.

If Jetty sees a cookie VALUE that starts with " (double quote), it will continue to read the cookie string until it sees a closing quote โ€“ even if a semicolon is encountered.

So, a cookie header such as:

DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d" will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d

instead of 3 separate cookies.

Impact

This has security implications because if, say, JSESSIONID is an HttpOnly cookie, and the DISPLAY_LANGUAGE cookie value is rendered on the page, an attacker can smuggle the JSESSIONID cookie into the DISPLAY_LANGUAGE cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server.

Patches

  • 9.4.51.v20230217 - via PR #9352
  • 10.0.15 - via PR #9339
  • 11.0.15 - via PR #9339

Workarounds

No workarounds

References

Affected configurations

Vulners
Node
org.eclipse.jetty\jettyMatchserver
OR
org.eclipse.jetty\jettyMatchserver
OR
org.eclipse.jetty\jettyMatchserver
OR
org.eclipse.jetty\jettyMatchserver

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

40.9%