PT-2018-3781 · Eclipse+1 · Eclipse Jetty Server+1

Published 2018-06-07 · Updated 2021-09-23 · CVE-2017-7658

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Jetty Server versions 9.2.x and older Eclipse Jetty Server versions 9.3.x (all non HTTP/1.x configurations) Eclipse Jetty Server versions 9.4.x (all HTTP/1.x configurations)

Description The issue is related to the implementation of the Hypertext Transfer Protocol (HTTP/1.1) in the Eclipse Jetty Server, specifically with the handling of Transfer-Encoding and Content-Length headers. When presented with two content-lengths headers, Jetty ignores the second. When presented with a content-length and a chunked encoding header, the content-length is ignored as per RFC 2616. This can lead to a situation where an intermediary decides on a shorter length but still passes on the longer body, causing the body content to be interpreted by Jetty as a pipelined request. If the intermediary is imposing authorization, the fake pipelined request can bypass that authorization, allowing for potential attacks such as HTTP Request Smuggling.

Recommendations For Eclipse Jetty Server versions 9.2.x and older, consider upgrading to a version that properly handles content-length headers to prevent HTTP Request Smuggling attacks. For Eclipse Jetty Server versions 9.3.x (all non HTTP/1.x configurations), ensure that the server is configured to correctly handle Transfer-Encoding and Content-Length headers to mitigate the vulnerability. For Eclipse Jetty Server versions 9.4.x (all HTTP/1.x configurations), review the server's configuration to ensure that it properly handles chunked encoding and content-length headers to prevent authorization bypass attacks. As a temporary workaround, consider restricting access to sensitive areas of the server to minimize the risk of exploitation until a proper fix is applied.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

ALT-PU-2019-2113

ALT-PU-2021-2857

BDU:2022-02206

CVE-2017-7658

DSA-4278-1

GHSA-6X9X-8QW9-9PP6

Affected Products

Alt Linux

Eclipse Jetty Server

References · 53

• https://osv.dev/vulnerability/GHSA-6x9x-8qw9-9pp6 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4278-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7658 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2021-2857 · Vendor Advisory
• https://oracle.com/technetwork/security-advisory/cpujan2019-5072801.html · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7658 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7658 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04177 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-7658 · Security Note
• https://bdu.fstec.ru/vul/2019-04281 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7658 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02668 · Security Note
• https://oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html · Patch
• https://debian.org/security/2018/dsa-4278 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7658 · Security Note