CVE-2021-28169: Eclipse Jetty Information Disclosure Flaw

CVE-2021-28169 Overview

CVE-2021-28169 is a path traversal vulnerability affecting Eclipse Jetty web server versions 9.4.40 and earlier, 10.0.2 and earlier, and 11.0.2 and earlier. The vulnerability exists in the ConcatServlet component, which fails to properly handle doubly encoded path sequences in HTTP requests. This flaw allows unauthenticated remote attackers to bypass access controls and retrieve sensitive files from the WEB-INF directory, including configuration files such as web.xml.

The ConcatServlet is commonly used to concatenate multiple resources into a single response for performance optimization. When processing requests, the servlet decodes the path parameter but fails to properly validate it after decoding, enabling attackers to use double URL encoding to circumvent security restrictions.

Critical Impact

Attackers can access protected resources within the WEB-INF directory, exposing sensitive application configuration, database credentials, security constraints, and implementation details that could facilitate further attacks.

Affected Products

• Eclipse Jetty versions <= 9.4.40
• Eclipse Jetty versions <= 10.0.2
• Eclipse Jetty versions <= 11.0.2
• Debian Linux 9.0 and 10.0
• Oracle Communications Cloud Native Core Policy 1.14.0
• Oracle REST Data Services
• NetApp Active IQ Unified Manager (Linux and Windows)
• NetApp HCI
• NetApp Management Services for Element Software
• NetApp Snap Creator Framework

Discovery Timeline

• June 9, 2021 - CVE-2021-28169 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-28169

Vulnerability Analysis

This vulnerability arises from improper input validation in the ConcatServlet component of Eclipse Jetty. The servlet is designed to concatenate multiple static resources into a single HTTP response, improving page load performance by reducing the number of HTTP requests. However, the path validation logic fails to account for doubly encoded characters.

When a request is received, the servlet performs URL decoding on path parameters. An attacker can craft a request using double URL encoding (e.g., %2557 which decodes to %57, then to W) to represent characters that would normally be blocked. This allows traversal into the protected WEB-INF directory, which typically contains sensitive application configuration including web.xml, servlet mappings, security constraints, and potentially database connection strings.

The information exposure can reveal critical implementation details about the web application, including authentication mechanisms, session configurations, error handling procedures, and third-party library dependencies. This intelligence can be leveraged to craft more sophisticated attacks against the application.

Root Cause

The root cause is insufficient input validation and improper handling of URL-encoded characters in the ConcatServlet. The servlet decodes the path parameter only once before performing security checks, but the decoded value still contains encoded characters that are decoded again during file access. This double-decoding behavior creates a security bypass where blocked path patterns like /WEB-INF/ can be represented as /%2557EB-INF/ to evade detection.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP GET requests to the ConcatServlet endpoint with doubly encoded path sequences. The attack is straightforward to execute and can be performed using simple tools like curl or a web browser.

For example, a malicious request to /concat?/%2557EB-INF/web.xml would bypass the path validation and allow the attacker to retrieve the contents of the web.xml configuration file. The %2557 sequence decodes first to %57, which then decodes to the character W, effectively constructing the restricted path /WEB-INF/web.xml after both decoding operations complete.

Detection Methods for CVE-2021-28169

Indicators of Compromise

• HTTP requests to /concat endpoints containing double-encoded characters such as %25 followed by hex values
• Access log entries showing requests with patterns like /%2557EB-INF/ or similar doubly encoded WEB-INF references
• Unusual access patterns to the ConcatServlet from external IP addresses
• HTTP 200 responses from /concat endpoints that should return 403 or 404 for restricted paths

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing double URL-encoded characters targeting known protected directories
• Configure IDS/IPS signatures to alert on patterns matching %25[0-9a-fA-F]{2} in request paths to servlet endpoints
• Enable detailed access logging on Jetty servers and monitor for requests containing encoded WEB-INF path fragments
• Deploy SentinelOne agents to detect anomalous file access patterns in web application directories

Monitoring Recommendations

• Review web server access logs for requests to /concat endpoints with unusual encoded parameters
• Monitor for information disclosure indicators such as web.xml content appearing in response bodies
• Establish baseline traffic patterns to ConcatServlet endpoints and alert on deviations
• Implement real-time alerting for any successful access to WEB-INF directory contents

How to Mitigate CVE-2021-28169

Immediate Actions Required

• Upgrade Eclipse Jetty to version 9.4.41 or later, 10.0.3 or later, or 11.0.3 or later immediately
• If upgrade is not immediately possible, disable or remove the ConcatServlet from your web application configuration
• Implement WAF rules to block requests containing double-encoded path traversal sequences
• Review access logs to determine if exploitation has occurred and assess potential data exposure

Patch Information

Eclipse has released patched versions that properly validate and sanitize path parameters in the ConcatServlet. Organizations should upgrade to the following fixed versions:

• Jetty 9.4.41 or later for the 9.x branch
• Jetty 10.0.3 or later for the 10.x branch
• Jetty 11.0.3 or later for the 11.x branch

Additional vendor patches are available from Oracle Security Alerts for affected Oracle products. Debian users should apply updates per Debian Security Advisory DSA-4949. NetApp customers should review the NetApp Security Advisory for guidance on affected products.

Workarounds

• Remove or disable the ConcatServlet mapping from web.xml if the functionality is not required
• Configure a reverse proxy or WAF to normalize and decode all URL parameters before they reach Jetty, then block requests containing WEB-INF paths
• Implement custom servlet filters that perform recursive URL decoding and validate paths before processing
• Restrict network access to Jetty instances to trusted sources only until patching can be completed

# Example: Disable ConcatServlet in web.xml
# Comment out or remove the following servlet mapping:
# <servlet-mapping>
#     <servlet-name>concat</servlet-name>
#     <url-pattern>/concat/*</url-pattern>
# </servlet-mapping>

# Verify Jetty version to confirm patch status
java -jar start.jar --version