#VU340 Security bypass in Jetty - CVE-2016-4800

Vulnerability identifier: #VU340

Vulnerability risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-4800

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Jetty
Server applications / Web servers

Vendor: Eclipse

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to an error within PathResource class when parsing URLs, which contains certain escaped characters. A remote unauthenticated attacker can bypass implemented security restrictions and gain access to protected resources (e.g. WEB-INF and META-INF folders and their contents) or bypass application filters or other restrictions, implemented in servlet configuration.

Successful exploitation of the vulnerability may allow an attacker to gain unauthorized access to otherwise protected resources.

Mitigation
Install the latest version 9.3.9.

Vulnerable software versions

Jetty: 9.3.0.v20150608 - 9.3.8.v20160311

---

External links
https://www.eclipse.org/jetty/documentation/9.4.x/security-reports.html
https://www.ocert.org/advisories/ocert-2016-001.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.