QID 980212

QID 980212: Java (maven) Security Update for org.eclipse.jetty:jetty-webapp (GHSA-vjv5-gp2w-65vm)

URIs can be crafted using some encoded characters to access the content of the `WEB-INF` directory and/or bypass some security constraints.
This is a variation of the vulnerability reported in [CVE-2021-28164](https://nvd.nist.gov/vuln/detail/CVE-2021-28164)/[GHSA-v7ff-8wcx-gmc5](https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5).

The default compliance mode allows requests with URIs that contain a %u002e segment to access protected resources within the WEB-INF directory. For example, a request to `/%u002e/WEB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Similarly, an encoded null character can prevent correct normalization so that /.%00/WEB-INF/web.xml cal also retrieve the web.xml file.

CVSS V3 rated as Medium - 5.3 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to refer to GHSA-vjv5-gp2w-65vm for updates pertaining to this vulnerability.Workaround:
Some Jetty [rewrite rules](https://www.eclipse.org/jetty/documentation/jetty-9/index.html#rewrite-handler) can be deployed to rewrite any request containing encoded dot segments or null characters in the raw request URI, to a known not found resource:
```xml
<Call name="addRule">
<Arg>
<New class="org.eclipse.jetty.rewrite.handler.RewriteRegexRule">
<Set name="regex">.*/(?:\.+/)+.*</Set>
<Set name="replacement">/WEB-INF/Not-Found</Set>
</New>
</Arg>
</Call>
<Call name="addRule">
<Arg>
<New class="org.eclipse.jetty.rewrite.handler.ValidUrlRule"/>
</Arg>
</Call>
```

Vendor References

GHSA-vjv5-gp2w-65vm - github.com/advisories/GHSA-vjv5-gp2w-65vm

CVEs related to QID 980212

CVE-2021-34429 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-vjv5-gp2w-65vm	org.eclipse.jetty:jetty-webapp		github.com/advisories/GHSA-vjv5-gp2w-65vm

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].