CVE-2023-26049: Eclipse Jetty Cookie Smuggling Vulnerability

CVE-2023-26049 Overview

CVE-2023-26049 is a cookie smuggling vulnerability in Eclipse Jetty, a popular Java-based web server and servlet engine. The vulnerability stems from nonstandard cookie parsing behavior that allows attackers to smuggle cookies within other cookies or perform unintended actions by tampering with the cookie parsing mechanism. This can lead to information disclosure, including the potential exfiltration of HttpOnly session cookies.

Critical Impact
Attackers can bypass cookie-based security policies and potentially exfiltrate HttpOnly session identifiers (like JSESSIONID) by exploiting the nonstandard cookie parsing behavior.

Affected Products

Eclipse Jetty (versions prior to 9.4.51, 10.0.14, 11.0.14, and 12.0.0.beta0)
Debian Linux 10.0, 11.0, 12.0
NetApp Active IQ Unified Manager (Linux and Windows)
NetApp E-Series SANtricity OS Controller
NetApp E-Series SANtricity Unified Manager
NetApp E-Series SANtricity Web Services

Discovery Timeline

2023-04-18 - CVE-2023-26049 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-26049

Vulnerability Analysis

This vulnerability exploits a parsing inconsistency in how Eclipse Jetty handles cookie values that begin with double quotes. According to RFC 6265, cookie parsing should follow specific delimiters, but Jetty's implementation deviates from standard behavior when encountering quoted values.

When Jetty encounters a cookie VALUE that starts with a double quote ("), it continues reading the cookie string until it finds a closing quote—even if semicolons (which normally delimit separate cookies) are encountered within the quoted section. This parsing behavior creates an opportunity for cookie smuggling attacks.

For example, a malicious cookie header like DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d" would be parsed as a single cookie named DISPLAY_LANGUAGE with the value b; JSESSIONID=1337; c=d, rather than being correctly interpreted as three separate cookies.

Root Cause

The root cause lies in Jetty's cookie parsing implementation, which follows an older interpretation based on RFC 2965 that allowed quoted cookie values. This creates a mismatch with modern cookie handling expectations and enables attackers to embed arbitrary cookie data within quoted strings, bypassing security controls that rely on proper cookie separation.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft a malicious HTTP request containing specially formatted cookie headers to exploit the parsing vulnerability.

The exploitation scenario works as follows:

The attacker identifies an application using a vulnerable version of Jetty
The attacker crafts a cookie header with a quoted value containing smuggled cookies
If the application renders any part of the smuggled cookie value (e.g., DISPLAY_LANGUAGE), HttpOnly cookies like JSESSIONID embedded within the quoted string may be exposed
This bypasses the HttpOnly protection mechanism designed to prevent client-side script access to sensitive session cookies

This attack is particularly dangerous when an intermediary (such as a reverse proxy or WAF) enforces cookie-based security policies, as the smuggled cookie can bypass those policies while still being processed by the Jetty server.

Detection Methods for CVE-2023-26049

Indicators of Compromise

HTTP requests containing cookie headers with unusual quoted values spanning multiple apparent cookie definitions
Cookie values containing embedded semicolons within double quotes
Log entries showing unexpected cookie parsing results or malformed cookie warnings
Session hijacking attempts following cookie exfiltration patterns

Detection Strategies

Implement web application firewall (WAF) rules to detect cookie headers containing quoted values with embedded semicolons
Monitor HTTP request logs for anomalous cookie header patterns, particularly values like "value; JSESSIONID=
Deploy network intrusion detection signatures to identify potential cookie smuggling attempts
Analyze application logs for unexpected cookie value rendering or exposure

Monitoring Recommendations

Enable verbose cookie parsing logging in Jetty to identify potential exploitation attempts
Monitor for session anomalies that could indicate successful cookie exfiltration
Implement alerting for HTTP requests with unusually long or complex cookie headers
Review access logs for patterns consistent with session hijacking following cookie smuggling

How to Mitigate CVE-2023-26049

Immediate Actions Required

Upgrade Eclipse Jetty to version 9.4.51, 10.0.14, 11.0.14, or 12.0.0.beta0 or later immediately
Review application code for any instances where cookie values are rendered in responses
Audit session management practices and ensure sensitive cookies use proper security attributes
Apply available operating system and third-party vendor patches for affected distributions

Patch Information

Eclipse has addressed this vulnerability in the following patched versions:

Jetty 9.4.x: Upgrade to version 9.4.51 or later
Jetty 10.x: Upgrade to version 10.0.14 or later
Jetty 11.x: Upgrade to version 11.0.14 or later
Jetty 12.x: Upgrade to version 12.0.0.beta0 or later

The fixes are available through the official Eclipse Jetty repository. Technical details of the patches can be found in Pull Request #9339 and Pull Request #9352. The official security advisory is available at GHSA-p26g-97m4-6q7c.

Additional vendor advisories:

Workarounds

There are no known workarounds for this vulnerability; upgrading to a patched version is the only remediation
As a defense-in-depth measure, avoid rendering cookie values in HTTP responses where possible
Implement strict input validation on any cookie values that must be processed or displayed
Consider deploying a WAF with rules to reject malformed cookie headers as a temporary mitigation layer

bash

# Verify Jetty version and upgrade
# Check current Jetty version in Maven pom.xml or build.gradle
# For Maven, update dependency version:
# <dependency>
#     <groupId>org.eclipse.jetty</groupId>
#     <artifactId>jetty-server</artifactId>
#     <version>11.0.14</version>
# </dependency>

# For Gradle:
# implementation 'org.eclipse.jetty:jetty-server:11.0.14'

# After updating, rebuild and redeploy the application
mvn clean install
# or
gradle clean build