CVE-2020-27216 Local Temp Directory Hijacking Vulnerability
A local attacker can exploit a race condition in temporary directory creation to gain read/write access to web application files, potentially leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-27216?
CVE-2020-27216 is a high-severity vulnerability in Debian Debian Linux, published on 23 Oct 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.
Which versions are affected by CVE-2020-27216?
12 open source packages ship an affected version, including org.eclipse.jetty:jetty-webapp and org.mortbay.jetty:jetty-webapp. It affects 18 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-webapp Maven | All versions | 9.4.33.v20201020 |
org.eclipse.jetty:jetty-webapp Maven | All versions | 9.4.33.v20201020 |
org.eclipse.jetty:jetty-webapp Maven | From 10.0.0.beta1 | 10.0.0.beta3 |
org.eclipse.jetty:jetty-webapp Maven | From 10.0.0.beta1 | 10.0.0.beta3 |
org.eclipse.jetty:jetty-webapp Maven | From 11.0.0.beta1 | 11.0.0.beta3 |
org.eclipse.jetty:jetty-webapp Maven | From 11.0.0.beta1 | 11.0.0.beta3 |
6 more packages
org.mortbay.jetty:jetty-webapp Maven | All versions | 9.4.33 |
org.mortbay.jetty:jetty-webapp Maven | All versions | 9.4.33 |
org.mortbay.jetty:jetty-webapp Maven | From 10.0.0.beta1 | 10.0.0.beta3 |
org.mortbay.jetty:jetty-webapp Maven | From 10.0.0.beta1 | 10.0.0.beta3 |
org.mortbay.jetty:jetty-webapp Maven | From 11.0.0.beta1 | 11.0.0.beta3 |
org.mortbay.jetty:jetty-webapp Maven | From 11.0.0.beta1 | 11.0.0.beta3 |
Linux distribution packages (28)
rh-eclipse Red Hat:devtools:2020 | All versions | 1:4.17-6.el7_9 |
rh-eclipse-ant Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-antlr Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-apache-bcel Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-apache-bsf Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-apache-log4j Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-apache-oro Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-apache-regexp Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-apache-resolver Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-apache-xalan2 Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-commons-logging Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-commons-net Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-imageio Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-javadoc Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-javamail Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-jdepend Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-jmf Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-jsch Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-junit Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-junit5 Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-lib Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-manual Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-swing Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-testutil Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-ant-xz Red Hat:devtools:2020 | All versions | 0:1.10.9-1.2.el7 |
rh-eclipse-antlr32 Red Hat:devtools:2020 | All versions | 0:3.2-28.1.el7 |
rh-eclipse-antlr32-java Red Hat:devtools:2020 | All versions | 0:3.2-28.1.el7 |
rh-eclipse-antlr32-javadoc Red Hat:devtools:2020 | All versions | 0:3.2-28.1.el7 |
Products include Apache Beam, Debian Debian Linux, Eclipse Jetty, Netapp Snap Creator Framework, Netapp Snapcenter, Netapp Storage Replication Adapter and 12 more.
How do I fix CVE-2020-27216?
Upgrade org.eclipse.jetty:jetty-webapp to a fixed version for your release line: 9.4.33.v20201020, 10.0.0.beta3 or 11.0.0.beta3.
Is CVE-2020-27216 being exploited?
There is no known exploitation of CVE-2020-27216 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2026-RM27801, DEBIAN-CVE-2020-27216, GHSA-g3wg-6mcf-8jj6, OESA-2021-1052, RHSA-2020:5168, UBUNTU-CVE-2020-27216.