Eclipse Jetty vulnerabilities

The exception handling code in Eclipse Jetty before version 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, known as JetLeak.

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode passwords as bytes, silently replacing characters outside that charset with '?'.

In Eclipse Jetty, SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.

In Eclipse Jetty, across various versions of jetty-security and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.

In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

In Eclipse Jetty, across various versions of jetty-security, jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods.

In Jetty's HttpClient, when a request is made through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy and re-sends the request with the Proxy-Authentication header, which reaches the server and exposes the proxy credentials to it.

In Eclipse Jetty, HttpClient may receive a redirect of the form /secure/../evil. If an attacker controls the redirects, HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and therefore follows the redirect sending the Authorization header for /secure to /evil.

In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.

In Eclipse Jetty, across various versions of jetty-annotations and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation and web.xml defined security-constraint on the same url-pattern were not applied if the web.xml had more than one url-pattern for a servlet and a security-constraint applied to only some of those url-pattern definitions.

In Eclipse Jetty, a vulnerability has been identified involving incorrect path resolution for URIs containing semicolons. A request to a resource like '/public;/../admin/secret.txt' results in Jetty returning an unresolved path '/public/../admin/secret.txt' instead of the expected '/admin/secret.txt'. Jetty itself is not vulnerable because it does not serve files that fail the alias check, but web applications relying on Jetty's path resolution may be confused.

In Eclipse Jetty for HTTP/1, HTTP/2, and HTTP/3 requests, there is no strict check that the request authority (host and port) matches the value provided in the Host header (if present). This mismatch can cause problems such as incorrect URI construction, virtual host selection, reverse proxying, misleading logs, and others.

In Eclipse Jetty, the first HTTP/1.1 request with trailers causes the server to retain those trailers for subsequent requests on the same connection. Subsequent requests without trailers report the trailers from the first request, while requests with their own trailers report the union of the first and current request's trailers.

Eclipse Jetty has an HTTP/1.1 request smuggling vulnerability related to chunk extension handling, where the parser terminates chunk extension parsing at \r\n inside quoted strings instead of treating it as an error.

In Eclipse Jetty, the JASPIAuthenticator class sets ThreadLocal variables during authentication but fails to clear them on early return. A subsequent request on the same thread inherits these values, leading to broken access control and privilege escalation.

In Eclipse Jetty versions 12.0.0-12.0.31 and 12.1.0-12.0.5, the GzipHandler class has a memory leak vulnerability. When a compressed HTTP request with Content-Encoding: gzip is processed and the response is not compressed, the JDK Inflater object is not released, causing a resource leak.