CVE-2017-7658 : Security Advisory and Response

In previous versions of the Eclipse Jetty Server, there was a vulnerability related to handling multiple content-length headers, potentially leading to HTTP Request Smuggling.

Understanding CVE-2017-7658

This CVE entry pertains to a security issue in Eclipse Jetty Server versions 9.2.x and older, 9.3.x, and 9.4.x.

What is CVE-2017-7658?

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), there was a problem with handling multiple content-length headers. The second content-length header was disregarded by Jetty. Additionally, if a content-length header and a chunked encoding header were both present, Jetty would ignore the content-length (in accordance with RFC 2616). This could lead to a situation where an intermediary, such as a proxy, would determine a shorter length but still pass on the longer body. In this case, Jetty might mistakenly interpret the body content as a pipelined request. If the intermediary had imposed authorization, this fake pipelined request could bypass that authorization.

The Impact of CVE-2017-7658

The vulnerability could allow malicious actors to bypass authorization mechanisms by manipulating content-length headers.

Technical Details of CVE-2017-7658

This section provides more in-depth technical insights into the CVE.

Vulnerability Description

The vulnerability in Eclipse Jetty Server allowed for the misinterpretation of HTTP requests, potentially leading to HTTP Request Smuggling.

Affected Systems and Versions

Affected versions include Eclipse Jetty Server 9.2.x and older, 9.3.x, and 9.4.x.

Exploitation Mechanism

Exploiting this vulnerability involved manipulating content-length headers to bypass authorization controls.

Mitigation and Prevention

Protecting systems from CVE-2017-7658 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update Eclipse Jetty Server to versions that address the vulnerability.
Monitor and filter incoming requests to detect any suspicious activity related to content-length headers.

Long-Term Security Practices

Regularly update and patch software to mitigate known vulnerabilities.
Implement secure coding practices to prevent similar issues in the future.

Patching and Updates

Apply patches provided by Eclipse Foundation to fix the vulnerability.