CVE-2021-34429 Encoded URIs can access WEB-INF directory in Eclipse Jetty
Attackers can craft encoded URIs to access WEB-INF content and bypass security constraints in Eclipse Jetty.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-34429?
CVE-2021-34429 is a medium-severity path traversal vulnerability in Eclipse Jetty, published on 15 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
Which versions are affected by CVE-2021-34429?
6 open source packages ship an affected version, including org.eclipse.jetty:jetty-webapp. It affects 18 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-webapp Maven | From 10.0.1 | 10.0.6 |
org.eclipse.jetty:jetty-webapp Maven | From 10.0.1 | 10.0.6 |
org.eclipse.jetty:jetty-webapp Maven | From 11.0.1 | 11.0.6 |
org.eclipse.jetty:jetty-webapp Maven | From 11.0.1 | 11.0.6 |
org.eclipse.jetty:jetty-webapp Maven | From 9.4.37 | 9.4.43 |
org.eclipse.jetty:jetty-webapp Maven | From 9.4.37 | 9.4.43 |
Linux distribution packages (4)
jetty-minimal SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 9.4.43-3.12.2 |
jetty-minimal SUSE:Linux Enterprise Module for Development Tools 15 SP3 | All versions | 9.4.43-3.12.2 |
jetty-minimal openSUSE:Leap 15.3 | All versions | 9.4.43-3.12.2 |
jetty-websocket openSUSE:Leap 15.3 | All versions | 9.4.43-3.12.2 |
Products include Eclipse Jetty, Netapp E-Series Santricity Os Controller, Netapp E-Series Santricity Web Services, Netapp Element Plug-in for Vcenter Server, Netapp Hci Management Node, Netapp Snap Creator Framework and 12 more.
How do I fix CVE-2021-34429?
Upgrade org.eclipse.jetty:jetty-webapp to a fixed version for your release line: 10.0.6, 11.0.6 or 9.4.43.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-34429 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-34429 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Eclipse Jetty
- CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
- CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server
- CVE-2018-12538 Access and integrity issue within Eclipse Jetty
- CVE-2026-10050 Digest authentication lossy encoding
- CVE-2025-5115 MadeYouReset HTTP/2 vulnerability
Sources
Also known as DEBIAN-CVE-2021-34429, GHSA-vjv5-gp2w-65vm, SUSE-SU-2021:2838-1, UBUNTU-CVE-2021-34429, openSUSE-SU-2021:2838-1.