GitStock

eclipse/jetty.project · Security

Directory exposure in jetty

GHSA ID
GHSA-j6qj-j888-vvgq
CVE ID
CVE-2021-28163
Severity
low
Published
Updated
CVSS
2.7 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v3
2.7 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Description

Impact

If the ${jetty.base} directory or the ${jetty.base}/webapps directory is a symlink (soft link in Linux), the contents of the ${jetty.base}/webapps directory may be deployed as a static web application, exposing the content of the directory for download.

For example, the problem manifests in the following ${jetty.base}:

demo-base/
├── etc
├── lib
├── resources
├── start.d
├── deploy
│   └── async-rest.war
└── webapps -> deploy

Workarounds

Do not use a symlink

CWEs

  • CWE-59 · Improper Link Resolution Before File Access ('Link Following')
  • CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor

References