SRC-2021-0017 : Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability

2021-05-0500:00:00

Steven Seeley (mr_me) of Qihoo 360 Vulcan Team

srcincite.io

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.006 Low

EPSS

Percentile

78.6%

JSON

Vulnerability Details:

This vulnerability allows remote attackers to disclose information on affected installations of Jetty Web Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ConcatServlet and WelcomeFilter classes. The issue results from the lack of proper validation of a user-supplied path. An attacker can leverage this vulnerability to disclose sensitive files under the web root context.

Affected Vendors:

Jetty

Affected Products:

org.eclipse.jetty:jetty-servlets

Vendor Response:

Jetty has issued an update to correct this vulnerability. More details can be found at: <https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq>