CVE-2020-27223 DOS vulnerability for Quoted Quality CSV headers
Attackers can cause high CPU usage and denial of service in Eclipse Jetty by sending requests with numerous quality parameters in Accept headers.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-27223?
CVE-2020-27223 is a medium-severity denial of service vulnerability in Apache Nifi, published on 26 Feb 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
Which versions are affected by CVE-2020-27223?
9 open source packages ship an affected version, including nifi, solr and spark. It affects 16 products.
| Package | Affected | Fixed in |
|---|---|---|
nifi Bitnami | From 1.13.0 to 1.13.0 | None |
solr Bitnami | From 8.8.1 | 8.8.2 |
spark Bitnami | From 3.1.1 | 3.1.2 |
org.eclipse.jetty:jetty-server Maven | From 10.0.0 | 10.0.1 |
org.eclipse.jetty:jetty-server Maven | From 10.0.0 | 10.0.1 |
org.eclipse.jetty:jetty-server Maven | From 11.0.0 | 11.0.1 |
3 more packages
org.eclipse.jetty:jetty-server Maven | From 11.0.0 | 11.0.1 |
org.eclipse.jetty:jetty-server Maven | From 9.4.6 | 9.4.37 |
org.eclipse.jetty:jetty-server Maven | From 9.4.6 | 9.4.37 |
Linux distribution packages (1)
jetty-minimal SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 9.4.38-3.6.2 |
Products include Apache Nifi, Apache Solr, Apache Spark, Debian Debian Linux, Eclipse Jetty, Netapp E-Series Santricity Os Controller and 10 more.
How do I fix CVE-2020-27223?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-27223 being exploited?
There is no known exploitation of CVE-2020-27223 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Apache Nifi
- CVE-2018-1309 Improper Restriction of XML External Entity Reference in Apache NiFi
- CVE-2017-15697 Apache NiFi XSS issue in context path handling
- CVE-2017-5636 Injection in Apache NiFi
- CVE-2026-68981 Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
- CVE-2023-36542 Apache NiFi: Potential Code Injection with Properties Referencing Remote Resources
Sources
Also known as BIT-nifi-2020-27223, BIT-solr-2020-27223, BIT-spark-2020-27223, DEBIAN-CVE-2020-27223, GHSA-m394-8rww-3jr7, SUSE-SU-2021:0940-1 and 1 more.