Update dependency org.eclipse.jetty:jetty-http to v12 [SECURITY] #48
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
11.0.6
->12.0.12
GitHub Vulnerability Alerts
CVE-2022-2047
Description
URI use within Jetty's
HttpURI
class can parse invalid URIs such ashttp://localhost;/path
as having an authority with a host oflocalhost;
.A URIs of the type
http://localhost;/path
should be interpreted to be either invalid or aslocalhost;
to be the userinfo and no host.However,
HttpURI.host
returnslocalhost;
which is definitely wrong.Impact
This can lead to errors with Jetty's
HttpClient
, and Jetty'sProxyServlet
/AsyncProxyServlet
/AsyncMiddleManServlet
wrongly interpreting an authority with no host as one with a host.Patches
Patched in PR #8146 for Jetty version 9.4.47.
Patched in PR #8014 for Jetty versions 10.0.10, and 11.0.10
Workarounds
None.
For more information
If you have any questions or comments about this advisory:
CVE-2023-40167
Impact
Jetty accepts the '+' character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response.
Workarounds
There is no workaround as there is no known exploit scenario.
Original Report
RFC 9110 Secion 8.6 defined the value of Content-Length header should be a string of 0-9 digits. However we found that Jetty accepts "+" prefixed Content-Length, which could lead to potential HTTP request smuggling.
Payload:
When sending this payload to Jetty, it can successfully parse and identify the length.
When sending this payload to NGINX, Apache HTTPd or other HTTP servers/parsers, they will return 400 bad request.
This behavior can lead to HTTP request smuggling and can be leveraged to bypass WAF or IDS.
CVE-2024-6763
Summary
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class,
HttpURI
, for URI/URL parsing.The
HttpURI
class does insufficient validation on the authority segment of a URI. However the behaviour ofHttpURI
differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. SpecificallyHttpURI
and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.Details
Affected components
The vulnerable component is the
HttpURI
class when used as a utility class in an application. The Jetty usage of the class is not vulnerable.Attack overview
The
HttpURI
class does not well validate the authority section of a URI. When presented with an illegal authority that may contain user info (eg username:password#@hostname:port), then the parsing of the URI is not failed. Moreover, the interpretation of what part of the authority is the host name differs from a common browser in that they also do not fail, but they select a different host name from the illegal URI.Attack scenario
A typical attack scenario is illustrated in the diagram below. The Validator checks whether the attacker-supplied URL is on the blocklist. If not, the URI is passed to the Requester for redirection. The Requester is responsible for sending requests to the hostname specified by the URI.
This attack occurs when the Validator is the
org.eclipse.jetty.http.HttpURI
class and the Requester is theBrowser
(include chrome, firefox and Safari). An attacker can send a malformed URI to the Validator (e.g.,http://browser.check%23%40vulndetector.com/
). After validation, the Validator finds that the hostname is not on the blocklist. However, the Requester can still send requests to the domain with the hostnamevulndetector.com
.PoC
payloads:
The problem of 302 redirect parsing in HTML tag scenarios. Below is a poc example. After clicking the button, the browser will open "browser.check", and jetty will parse this URL as "vulndetector.com".
A comparison of the parsing differences between Jetty and chrome is shown in the table below (note that neither should accept the URI as valid).
The problem of 302 redirect parsing in HTTP 302 Location
It is noteworthy that Spring Web also faced similar security vulnerabilities, being affected by the aforementioned four types of payloads. These issues have since been resolved and have been assigned three CVE numbers [3-5].
Impact
The impact of this vulnerability is limited to developers that use the Jetty HttpURI directly. Example: your project implemented a blocklist to block on some hosts based on HttpURI's handling of authority section. The vulnerability will help attackers bypass the protections that developers have set up for hosts. The vulnerability will lead to SSRF[1] and URL Redirection[2] vulnerabilities in several cases.
Mitigation
The attacks outlined above rely on decoded user data being passed to the
HttpURI
class. Application should not pass decoded user data as an encoded URI to any URI class/method, includingHttpURI
. Such applications are likely to be vulnerable in other ways.The immediate solution is to upgrade to a version of the class that will fully validate the characters of the URI authority. Ultimately, Jetty will deprecate and remove support for user info in the authority per RFC9110 Section 4.2.4.
Note that the Chrome (and other browsers) parse the invalid user info section improperly as well (due to flawed WhatWG URL parsing rules that do not apply outside of a Web Browser).
Reference
[1] https://cwe.mitre.org/data/definitions/918.html
[2] https://cwe.mitre.org/data/definitions/601.html
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.