CVE-2023-36479 Overview
CVE-2023-36479 affects the Eclipse Jetty CgiServlet component within the org.eclipse.jetty.servlets.CGI package. The flaw allows authenticated users to trigger execution of an unintended command when invoking a CGI binary with a specially crafted name. When a binary name contains a space, Jetty wraps the command in quotation marks before passing it to Runtime.exec. If the binary name also contains a quotation mark followed by a space, the quoted command line breaks into multiple tokens, causing the wrong command to be executed. The Eclipse Foundation patched the issue in Jetty versions 9.4.52, 10.0.16, 11.0.16, and 12.0.0-beta2.
Critical Impact
Attackers with the ability to control CGI binary names can cause execution of unintended commands through Runtime.exec token splitting.
Affected Products
- Eclipse Jetty versions prior to 9.4.52, 10.0.16, 11.0.16, and 12.0.0-beta2
- Eclipse Jetty 12.0.0 alpha1, alpha2, alpha3, beta0, and beta1 releases
- Debian Linux 10, 11, and 12 distributions packaging affected Jetty versions
Discovery Timeline
- 2023-09-15 - CVE-2023-36479 published to NVD
- 2025-05-27 - Last updated in NVD database
Technical Details for CVE-2023-36479
Vulnerability Analysis
The vulnerability resides in how org.eclipse.jetty.servlets.CGI constructs the command line passed to Runtime.exec. When a request targets a CGI binary whose filename contains whitespace, the servlet wraps the binary path in double quotes to preserve it as a single argument. The servlet then optionally prepends a configured command prefix and forwards the resulting string to Runtime.exec(String).
Java's Runtime.exec(String) tokenizes its argument using StringTokenizer and does not interpret shell-style quoting. The CGI servlet's manual quoting therefore provides no protection once the binary name itself contains a quotation mark. The classification corresponds to [CWE-149] (Improper Neutralization of Quoting Syntax).
Root Cause
The root cause is a mismatch between the servlet's string-based quoting logic and Java's whitespace-only argument splitting in Runtime.exec(String). The servlet assumes quoted strings will be treated atomically, but the runtime splits on spaces regardless of surrounding quotes. A crafted binary name containing " injects token boundaries that fragment the command into multiple arguments.
Attack Vector
Exploitation requires that the CgiServlet be deployed and reachable, that the attacker can place or request a CGI binary whose name contains a quotation mark followed by a space, and that the attacker has low-level privileges to send requests. The attack complexity is high because the target environment must use CGI and permit binary names with embedded quotes and spaces. Refer to the GitHub Security Advisory GHSA-3gh6-v5v9-6v9j for the upstream technical description.
Detection Methods for CVE-2023-36479
Indicators of Compromise
- CGI requests targeting binaries with filenames containing both quotation marks and spaces
- Unexpected child processes spawned by Jetty Java processes that do not match deployed CGI binaries
- Access log entries to /cgi-bin/ paths with URL-encoded %22 (quote) and %20 (space) sequences in the script name
Detection Strategies
- Inventory all Jetty deployments and confirm whether org.eclipse.jetty.servlets.CGI is enabled in web.xml or programmatic servlet registrations
- Inspect CGI binary directories for files whose names contain quotation marks or other shell metacharacters
- Correlate web access logs with process execution telemetry to identify CGI requests that produced unexpected exec events
Monitoring Recommendations
- Alert on Java process trees where the Jetty server spawns child processes outside the expected CGI binary set
- Monitor for HTTP request paths containing encoded quote characters routed to CGI handlers
- Track Jetty version strings across the fleet to confirm patched releases are deployed
How to Mitigate CVE-2023-36479
Immediate Actions Required
- Upgrade Eclipse Jetty to 9.4.52, 10.0.16, 11.0.16, or 12.0.0-beta2 or later
- Apply the Debian security update referenced in DSA-5507 for affected Debian Linux versions
- Audit deployed CGI binaries and remove any filenames containing quotation marks, spaces, or other shell metacharacters
Patch Information
The fix landed across multiple Jetty branches via GitHub Pull Request #9516, GitHub Pull Request #9888, and GitHub Pull Request #9889. The Debian project shipped corresponding package updates documented in the Debian LTS Announcement.
Workarounds
- Disable the CgiServlet if CGI execution is not required by the application
- Restrict the CGI binary directory to a controlled allowlist of filenames that contain no whitespace or quotation marks
- Place Jetty behind a reverse proxy that rejects request paths containing encoded quote characters destined for CGI endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
