CVE-2023-36479: Critical Vulnerability in Eclipse Jetty Canonical Repository

Eclipse Jetty Canonical Repository is the primary repository for the Jetty project, providing a high-performance, easy-to-use, and secure platform for web applications. However, a critical vulnerability has been identified within the system, specifically relating to the CgiServlet function. This vulnerability could allow an attacker to execute arbitrary commands on the server when specific conditions are met.

Vulnerability Details

The vulnerability, assigned the identifier CVE-2023-36479, affects the org.eclipse.jetty.servlets.CGI Servlet when processing a request for a binary with a space in its name. The CgiServlet will escape the command by wrapping it in quotation marks, then execute the wrapped command, plus an optional command prefix, through a call to Runtime.exec.

If the attacker submits a binary name containing a quotation mark followed by a space, the resulting command line will be divided into multiple tokens instead of one. This may result in executing the incorrect command. This issue has been patched in Jetty version 9.4.52, 10..16, 11..16, and 12..-beta2.

Example Code Snippet

/* Servlet call */
org.eclipse.jetty.servlets.CGI

/* Original Binary Name submitted by the attacker */
binary_name_with_space" additional_command

/* Resulting command after wrapping in quotation marks */
"binary_name_with_space" additional_command"

/* Incorrect additional command may be executed due to multiple tokens */
additional_command

References

1. Eclipse Jetty Official Page: Eclipse Jetty Canonical Repository
2. Jetty Version Information: Jetty Version Docs
3. Jetty Issue Report: Jetty GitHub Issue #962

Exploit Details

In order to exploit this vulnerability, an attacker would need to craft a specific HTTP request to the Jetty CgiServlet, containing the binary name with a space, a quotation mark, and an additional command. By doing so, they could potentially execute the incorrect command on the server, leading to unexpected consequences, potentially including data leakage, unauthorized access, or even server compromise.

Mitigation and Recommendations

The Jetty project has released patches for this vulnerability in versions 9.4.52, 10..16, 11..16, and 12..-beta2. It is highly recommended for users to update their Jetty installations to the latest patched version to avoid potential exploitation.

In addition, server administrators should ensure proper access controls and user input validation are in place, preventing unauthorized users from sending malicious requests to the CgiServlet, and limiting the scope for exploitation.

Conclusion

The discovery of this critical vulnerability in the Jetty project highlights the importance of continuous monitoring and patching of web application frameworks, as well as the need for robust input validation and access controls. Administrators must remain vigilant to safeguard their systems and maintain the integrity of their web applications.

Timeline

Published on: 09/15/2023 19:15:00 UTC
Last modified on: 10/16/2023 19:20:00 UTC