CVE-2021-28169 Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability

Q: Which versions are affected by CVE-2021-28169?

6 open source packages ship an affected version, including org.eclipse.jetty:jetty-servlets. It affects 8 products.

Q: Is CVE-2021-28169 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-28169 exists.

Q: How do I fix CVE-2021-28169?

Upgrade org.eclipse.jetty:jetty-servlets to a fixed version for your release line: 9.4.41, 10.0.3 or 11.0.3.

Medium 5.3 Published 9 Jun 2021 Updated 3 Aug 2024

Attackers can access protected WEB-INF resources like web.xml via doubly encoded paths in ConcatServlet, revealing sensitive application implementation details.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2021-28169?

CVE-2021-28169 is a medium-severity path traversal vulnerability in Debian Debian Linux, published on 9 Jun 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Weakness: CWE-200

Which versions are affected by CVE-2021-28169?

6 open source packages ship an affected version, including org.eclipse.jetty:jetty-servlets. It affects 8 products.

Package	Affected	Fixed in
`org.eclipse.jetty:jetty-servlets` Maven	All versions	`9.4.41`
`org.eclipse.jetty:jetty-servlets` Maven	All versions	`9.4.41`
`org.eclipse.jetty:jetty-servlets` Maven	From `10.0.0`	`10.0.3`
`org.eclipse.jetty:jetty-servlets` Maven	From `10.0.0`	`10.0.3`
`org.eclipse.jetty:jetty-servlets` Maven	From `11.0.0`	`11.0.3`
`org.eclipse.jetty:jetty-servlets` Maven	From `11.0.0`	`11.0.3`

Products include Debian Debian Linux, Eclipse Jetty, Netapp Active Iq Unified Manager, Netapp Hci, Netapp Management Services for Element Software, Netapp Snap Creator Framework and 2 more.

How do I fix CVE-2021-28169?

Upgrade org.eclipse.jetty:jetty-servlets to a fixed version for your release line: 9.4.41, 10.0.3 or 11.0.3.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2021-28169 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-28169 exists.

Public exploit code: 1 Nuclei template.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-28169, DLA-2688-1, GHSA-gwcr-j4wh-j3cq, OESA-2021-1249, UBUNTU-CVE-2021-28169.