Arbitrary Code Execution Affecting org.eclipse.jetty.ee10:jetty-ee10-servlets package, versions [,12.0.0-beta2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGECLIPSEJETTYEE10-5903002
- published 15 Sep 2023
- disclosed 14 Sep 2023
- credit Kelly Kaoudis, Joakim Erdfelt
Introduced: 14 Sep 2023
CVE-2023-36479 Open this link in a new tabHow to fix?
Upgrade org.eclipse.jetty.ee10:jetty-ee10-servlets to version 12.0.0-beta2 or higher.
Overview
Affected versions of this package are vulnerable to Arbitrary Code Execution. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks.
Impact:
This behavior may bypass alias checks, and it may cause other unintended behaviors if a command prefix is configured.
Note:
In Jetty 9.x, 10.x, and 11.x the org.eclipse.jetty.servlets.CGI has been deprecated.
In Jetty 12 (all environments) the org.eclipse.jetty.servlets.CGI has been entirely removed.
PoC
if (execCmd.length() > 0 && execCmd.charAt(0) != '"' && execCmd.contains(" "))
execCmd = "\"" + execCmd + "\"";