CVE-2021-28163 Directory exposure in jetty
Attackers can read sensitive files if the webapps directory is a symlink, exposing deployed applications and directory contents.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-28163?
CVE-2021-28163 is a low-severity path traversal vulnerability in Eclipse Jetty, published on 1 Apr 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
Which versions are affected by CVE-2021-28163?
7 open source packages ship an affected version, including org.eclipse.jetty:jetty-deploy and solr. It affects 23 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-deploy Maven | From 10.0.0 | 10.0.2 |
org.eclipse.jetty:jetty-deploy Maven | From 10.0.0 | 10.0.2 |
org.eclipse.jetty:jetty-deploy Maven | From 11.0.0 | 11.0.2 |
org.eclipse.jetty:jetty-deploy Maven | From 11.0.0 | 11.0.2 |
org.eclipse.jetty:jetty-deploy Maven | From 9.4.32 | 9.4.39 |
org.eclipse.jetty:jetty-deploy Maven | From 9.4.32 | 9.4.39 |
1 more packages
solr Bitnami | From 8.8.1 | 8.8.2 |
Products include Apache Ignite, Apache Solr, Eclipse Jetty, Fedoraproject Fedora, Netapp Cloud Manager, Netapp E-Series Performance Analyzer and 17 more.
How do I fix CVE-2021-28163?
Upgrade org.eclipse.jetty:jetty-deploy to a fixed version for your release line: 10.0.2, 11.0.2 or 9.4.39.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-28163 being exploited?
There is no known exploitation of CVE-2021-28163 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Jetty
- CVE-2018-1273 VMware Tanzu Spring Data Commons Property Binder
- CVE-2018-8018 Code execution via deserialization in org.apache.ignite:ignite-core
- CVE-2018-1295 Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization
- CVE-2024-52577 Apache Ignite: Possible RCE when deserializing incoming messages by the server node
- CVE-2020-1963 File system access via H2 in Apache Ignite
Sources
Also known as BIT-solr-2021-28163, DEBIAN-CVE-2021-28163, GHSA-j6qj-j888-vvgq, UBUNTU-CVE-2021-28163.