CVE-2021-28163 : Security Advisory and Response

Eclipse Jetty versions 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1 are affected by a vulnerability where using a webapps directory that is a symlink can inadvertently serve the webapps themselves and other content.

Understanding CVE-2021-28163

This section will cover what CVE-2021-28163 entails, its impacts, technical details, and mitigation strategies.

What is CVE-2021-28163?

CVE-2021-28163 affects Eclipse Jetty, allowing the contents of webapps directory to be deployed as static webapps if it is a symlink, exposing sensitive data.

The Impact of CVE-2021-28163

The vulnerability exposes the webapps themselves and any other content in the directory, posing a risk of unauthorized access and data exposure.

Technical Details of CVE-2021-28163

This section explores the specific technical aspects of the CVE, including vulnerability description, affected systems, and exploitation mechanisms.

Vulnerability Description

The vulnerability occurs when a user employs a webapps directory that is a symlink in affected versions of Eclipse Jetty, resulting in the unintended serving of the webapps themselves as static content.

Affected Systems and Versions

Eclipse Jetty versions 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1 are impacted by this symlink-related vulnerability.

Exploitation Mechanism

By utilizing a symlink for the webapps directory, attackers can exploit the vulnerability to access sensitive data stored within the webapps themselves.

Mitigation and Prevention

This section outlines the immediate steps to take to address the CVE, as well as long-term security practices and the importance of patching and updates.

Immediate Steps to Take

Users should avoid using symlinked directories for webapps, implement access controls, and monitor web server activity for suspicious behavior.

Long-Term Security Practices

Developers should follow secure coding practices, regularly audit and validate directory structures, and stay informed about security patches and updates.

Patching and Updates

It is crucial to install the latest updates and patches provided by Eclipse Foundation for the affected Jetty versions to mitigate the CVE-2021-28163 vulnerability.