QID 980355

QID 980355: Java (maven) Security Update for org.eclipse.jetty:jetty-servlets (GHSA-gwcr-j4wh-j3cq)

Requests to the `ConcatServlet` and `WelcomeFilter` are able to access protected resources within the `WEB-INF` directory. For example a request to the `ConcatServlet` with a URI of `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

This occurs because both `ConcatServlet` and `WelcomeFilter` decode the supplied path to verify it is not within the `WEB-INF` or `META-INF` directories. It then uses this decoded path to call `RequestDispatcher` which will also do decoding of the path. This double decoding allows paths with a doubly encoded `WEB-INF` to bypass this security check.

This affects all versions of `ConcatServlet` and `WelcomeFilter` in versions before 9.4.41, 10.0.3 and 11.0.3.

CVSS V3 rated as Medium - 5.3 severity.

CVSS V2 rated as Medium - 5 severity.

Solution

Customers are advised to refer to GHSA-gwcr-j4wh-j3cq for updates pertaining to this vulnerability.Workaround:
If you cannot update to the latest version of Jetty, you can instead deploy your own version of the [`ConcatServlet`](https://github.com/eclipse/jetty.project/blob/4204526d2fdad355e233f6bf18a44bfe028ee00b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/ConcatServlet.java) and/or the [`WelcomeFilter`](https://github.com/eclipse/jetty.project/blob/4204526d2fdad355e233f6bf18a44bfe028ee00b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/WelcomeFilter.java) by using the code from the latest version of Jetty.

Vendor References

GHSA-gwcr-j4wh-j3cq - github.com/advisories/GHSA-gwcr-j4wh-j3cq

CVEs related to QID 980355

CVE-2021-28169 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-gwcr-j4wh-j3cq	org.eclipse.jetty:jetty-servlets		github.com/advisories/GHSA-gwcr-j4wh-j3cq

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].