HTTP/1.1 Request Trailer Leak in Eclipse Jetty

Executive Summary

This vulnerability affects Eclipse Jetty, a popular Java-based web server and servlet container. When a client sends an HTTP/1.1 request with trailers (additional headers sent after the request body), the server incorrectly retains those trailers for subsequent requests made over the same connection.

• If a later request on the same connection does not include trailers, the server will incorrectly report the trailers from the first request.
• If a later request includes its own trailers, the server will merge them with the retained trailers from the first request, potentially exposing unintended data.

This issue is classified under CWE-200, which involves the exposure of sensitive information to unauthorized actors. The vulnerability affects Eclipse Jetty versions 12.0.0 through 12.0.35 and 12.1.0 through 12.1.9.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your Eclipse Jetty server is processing HTTP/1.1 requests with trailers and verifying if trailers from an initial request are incorrectly retained in subsequent requests over the same connection.

• Identify the version of Eclipse Jetty running on your system. The vulnerability affects versions 12.0.0 through 12.0.35 and 12.1.0 through 12.1.9. You can check the version by running the following command if Jetty is running as a standalone server: java -jar start.jar --version.
• Use network monitoring tools like Wireshark or tcpdump to capture HTTP/1.1 traffic to your Jetty server. Look for requests with trailers and observe if subsequent requests over the same connection incorrectly include trailers from the first request. Example tcpdump command: tcpdump -i <interface> -w jetty_traffic.pcap port <jetty_port>.
• Send crafted HTTP/1.1 requests with trailers to your Jetty server and inspect the responses. If trailers from the first request appear in subsequent requests, the vulnerability is present. Example using curl: curl -v --http1.1 -H 'Trailer: X-Test' -H 'X-Test: value' http://<jetty_server>:<port>/endpoint.
• Check server logs for unusual trailer headers in requests or responses. If trailers from previous requests appear in unrelated requests, this may indicate the vulnerability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using an affected version of Eclipse Jetty.

• Sensitive information leakage: Trailers from one request may unintentionally appear in subsequent requests, potentially exposing confidential data like authentication tokens, session identifiers, or other sensitive headers.
• Data integrity issues: If trailers are merged incorrectly, applications relying on trailer values may process corrupted or misleading data, leading to incorrect behavior or security bypasses.
• Compliance risks: Unauthorized exposure of sensitive data may violate data protection policies or regulatory requirements, depending on the nature of the information handled by your application.

The CVSS score of 4.0 indicates a low impact on confidentiality, integrity, and availability, but the actual risk depends on how your application uses HTTP trailers and the sensitivity of the data involved.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can affect compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the leaked trailers contain personal data (e.g., session tokens, user identifiers, or other personally identifiable information), this could constitute a data breach under GDPR. Organizations may be required to report the incident and could face penalties if proper safeguards were not in place.
• HIPAA (Health Insurance Portability and Accountability Act): If the affected system processes protected health information (PHI) and the trailers expose such data, this could violate HIPAA's Privacy and Security Rules. Covered entities and business associates may need to conduct a risk assessment and implement corrective actions.
• Other standards: Depending on the industry, this vulnerability may also impact compliance with frameworks like PCI DSS (if payment data is exposed) or ISO 27001 (if the organization's information security management system does not adequately address such risks).

The severity of compliance implications depends on the nature of the data handled by the affected application and whether the organization can demonstrate that appropriate mitigations were in place.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade Eclipse Jetty to a version beyond the affected ranges (12.0.0 through 12.0.35 and 12.1.0 through 12.1.9). Check the Eclipse Jetty release notes or security advisories for the latest patched version.
• If upgrading is not immediately possible, disable HTTP/1.1 trailer support in Jetty. This can be done by configuring the server to reject or ignore trailer headers. Refer to Jetty's documentation for configuration options related to HTTP/1.1 trailers.
• Implement network-level protections such as a web application firewall (WAF) to filter out or normalize trailer headers in HTTP/1.1 requests.
• Monitor your Jetty server for unusual activity, particularly requests that include unexpected trailer headers. Log and review such requests to detect potential exploitation attempts.
• Restrict persistent HTTP connections if they are not required for your application. This reduces the likelihood of trailer leakage between requests over the same connection.

Useful 0 Not Useful 0