what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Jetty 9.3.8 Path Sanitization

Jetty 9.3.8 Path Sanitization
Posted May 30, 2016
Authored by Open Source CERT, Daniele Bianco, Simon Zuckerbraun

The Jetty path normalization mechanism suffers of an implementation issue when parsing the request URLs. The path normalization logic implemented in the PathResource class and introduced in Jetty versions 9.3.x can be defeated by requesting malicious URLs containing specific escaped characters. Leveraging on this weakness, a malicious user can gain access to protected resources (e.g. WEB-INF and META-INF folders and their contents) and defeat application filters or other security constraints implemented in the servlet configuration. Versions 9.3.0 through 9.3.8 are affected.

tags | advisory, web
advisories | CVE-2016-4800
SHA-256 | 26929157b560ea70de00b08c35d3faa27d7dde2502ff66c5a5de0ac9128cc9bc

Jetty 9.3.8 Path Sanitization

Change Mirror Download

Description:

Jetty is a Java HTTP (Web) server and Servlet container.

The Jetty path normalization mechanism suffers of an implementation issue
when parsing the request URLs.

The path normalization logic implemented in the PathResource class and
introduced in Jetty versions 9.3.x can be defeated by requesting malicious
URLs containing specific escaped characters.

Leveraging on this weakness, a malicious user can gain access to protected
resources (e.g. WEB-INF and META-INF folders and their contents) and defeat
application filters or other security constraints implemented in the
servlet configuration.

A workaround to mitigate the issue, using the 'rewrite' module, can
alternatively be implemented as follows:

$ java -jar ../start.jar --module=rewrite etc/backslashalias.xml

or

$ java -jar ../start.jar --add-to-startd=rewrite
$ java -jar ../start.jar etc/backslashalias.xml

Workaround file backslashalias.xml contents:

<?xml version="1.0"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_3.dtd">
<Configure id="Rewrite" class="org.eclipse.jetty.rewrite.handler.RuleContainer">
<Call name="addRule">
<Arg>
<New class="org.eclipse.jetty.rewrite.handler.RedirectRegexRule">
<Arg>.*\\.*</Arg>
<Arg>/</Arg>
<Set name="statusCode">404</Set>
</New>
</Arg>
</Call>
</Configure>


Affected version:

Jetty >= 9.3.0, <= 9.3.8

Fixed version:

Jetty >= 9.3.9

Credit: vulnerability reported by Simon Zuckerbraun of Trend Micro Zero Day Initiative

CVE: CVE-2016-4800

Timeline:

2016-05-03: vulnerability report received
2016-05-06: contacted maintainer
2016-05-11: patch provided by maintainer
2016-05-13: assigned CVE
2016-05-18: reporter confirms patch
2016-05-20: contacted affected vendors
2016-05-30: advisory release

References:
http://www.eclipse.org/jetty/download.html

Permalink:
http://www.ocert.org/advisories/ocert-2016-001.html

--
Daniele Bianco Open Source Computer Security Incident Response Team
<danbia@ocert.org> http://www.ocert.org

GPG Key 0x9544A497
GPG Key fingerprint = 88A7 43F4 F28F 1B9D 6F2D 4AC5 AE75 822E 9544 A497
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close