Description
A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.
CVSS breakdown
CVSS 4.0
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Confidentiality (Vulnerable System)
Low
Integrity (Vulnerable System)
High
Availability (Vulnerable System)
None
Confidentiality (Subsequent System)
None
Integrity (Subsequent System)
None
Availability (Subsequent System)
None
Affected products
- Eclipse Foundation / Eclipse Jetty12.1.0 – 12.1.11
- Eclipse Foundation / Eclipse Jetty12.0.0 – 12.0.37
- Eclipse Foundation / Eclipse Jetty11.0.0 – 11.0.31
- Eclipse Foundation / Eclipse Jetty10.0.0 – 10.0.31
- Eclipse Foundation / Eclipse Jetty9.4.0 – 9.4.63
References
Updated 43m ago · 8 sources