PT-2023-26474 · Jetty+3 · Jetty+3

Highminwoox · Published 2023-07-25 · Updated 2023-08-03 · CVE-2023-38493

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Armeria versions prior to 1.24.3

Description The issue arises when Spring integration is used in Armeria, and the framework calls Spring controllers via TomcatService or JettyService with paths containing matrix variables. In such cases, the Armeria decorators may not be invoked due to the presence of matrix variables, potentially allowing an attacker to bypass the authorizer by sending a specially crafted request. For example, a request to /important;a=b/resources could bypass the authorizer.

Recommendations For versions prior to 1.24.3, update to version 1.24.3 to resolve the issue. As a temporary workaround, consider adding decorators using regex, such as "regex:^/important.*", to ensure that the authorizer is invoked correctly.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2023-38493

GHSA-WVP2-9PPW-337J

Affected Products

Armeria

Jetty

Spring

Apache Tomcat

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38493.json · Exploit
• https://github.com/line/armeria/security/advisories/GHSA-wvp2-9ppw-337j · Vendor Advisory
• https://github.com/line/armeria/commit/039db50bbfc88014ea8737fd1e1ddd6fd3fc4f07 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-38493 · Security Note
• https://osv.dev/vulnerability/GHSA-wvp2-9ppw-337j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38493 · Vendor Advisory
• https://github.com/line/armeria · Note
• https://github.com/line/armeria/commit/49e04ef231ad65750739529c7fa4ce946ff7588b · Note
• https://t.me/cibsecurity/67266 · Telegram Post
• https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-methods/matrix-variables.html · Note