Path Traversal in Eclipse Jetty

Executive Summary

This vulnerability affects Eclipse Jetty, a popular Java-based web server and servlet container. The issue occurs when an HTTP URI contains a semicolon followed by a path traversal sequence, such as "/public;/../admin/secret.txt".

Instead of resolving the path to the expected "/admin/secret.txt", Jetty returns an unresolved path like "/public/../admin/secret.txt". While Jetty itself is not directly vulnerable because it blocks access to resolved resources through alias checks, web applications that depend on Jetty to provide resolved paths may receive these unresolved paths.

This can lead to confusion or unintended behavior in the web application, as it may not handle unresolved paths correctly. The vulnerability is classified under CWE-647, which involves the improper neutralization of special elements in an expression language statement.

• Affected versions: Eclipse Jetty 12.0.0 to 12.0.34 and 12.1.0 to 12.1.8.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can test if your Eclipse Jetty server or web application improperly handles URIs containing semicolons followed by path traversal sequences. This can be done by sending crafted HTTP requests and observing the server's response.

• Use curl to send a request with a semicolon and path traversal sequence, such as: curl -v "http://<your-server>/public;/../admin/secret.txt". Replace <your-server> with your server's address and adjust the path as needed.
• Check the server's response. If the resolved path in the response or logs shows "/public/../admin/secret.txt" instead of "/admin/secret.txt", the vulnerability may be present.
• Inspect application logs for unexpected or unresolved paths that include semicolons or path traversal sequences.
• Verify the version of Eclipse Jetty in use. Versions 12.0.0 to 12.0.34 and 12.1.0 to 12.1.8 are affected.

Useful 0 Not Useful 0

Impact Analysis

If you are using a web application that relies on Eclipse Jetty to provide resolved paths, this vulnerability could impact you in the following ways:

• The application may receive unexpected or malformed paths, leading to incorrect behavior or errors in processing requests.
• If the application does not properly validate or handle unresolved paths, it might expose unintended resources or functionality, though Jetty itself prevents direct access to sensitive files.
• There is a low risk of integrity impact (I:L in CVSS), meaning the vulnerability could potentially allow an attacker to manipulate how the application interprets paths, but it does not directly lead to data exposure or system compromise.

The vulnerability does not allow direct access to sensitive files or data, as Jetty's alias checks block such access. However, it could cause logical errors or unexpected behavior in the application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability has limited direct impact on compliance with common standards and regulations like GDPR or HIPAA, but it could still pose indirect risks:

• GDPR: While the vulnerability does not directly expose personal data, if an application mishandles unresolved paths and inadvertently processes or logs incorrect data, it could lead to non-compliance with GDPR's data accuracy or integrity requirements.
• HIPAA: Similarly, if the application processes healthcare-related data and relies on resolved paths for access control, the vulnerability could cause misrouting of requests, potentially violating HIPAA's safeguards for protected health information (PHI).

The primary concern is the potential for logical errors or unintended behavior in the application, which could indirectly affect compliance if it leads to improper handling of regulated data. However, the vulnerability itself does not directly violate these standards.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these steps:

• Upgrade Eclipse Jetty to a version beyond the affected ranges (12.0.0 to 12.0.34 or 12.1.0 to 12.1.8). The fix has been proposed in pull request #14969.
• If upgrading is not immediately possible, review your web application's code to ensure it does not rely on Jetty to resolve paths. Manually handle path resolution to avoid confusion from unresolved paths.
• Implement input validation to reject or sanitize URIs containing semicolons or path traversal sequences before they reach the Jetty server.
• Monitor application behavior for any unexpected issues related to path resolution, especially in areas where file access or routing is critical.

Useful 0 Not Useful 0