CVE Vulnerabilities

CVE-2021-28163

Improper Link Resolution Before File Access ('Link Following')

Published: Apr 01, 2021 | Modified: May 12, 2022
CVSS 3.x
2.7
LOW
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:N
RedHat/V2
RedHat/V3
2.7 MODERATE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Ubuntu

In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.

Weakness

The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Software

Name Vendor Start Version End Version
Jetty Eclipse 11.0.0 11.0.0
Jetty Eclipse 10.0.0 10.0.0
Jetty Eclipse 11.0.0 11.0.0
Jetty Eclipse 11.0.1 11.0.1
Jetty Eclipse 11.0.0 11.0.0
Jetty Eclipse 10.0.1 10.0.1
Jetty Eclipse 9.4.32 *
Red Hat AMQ Broker 7 RedHat jetty-server *
Red Hat AMQ Broker 7 RedHat jetty-server *
Red Hat AMQ Streams 1 RedHat jetty-server *
Red Hat AMQ Streams 1 RedHat *
Red Hat Developer Tools RedHat rh-eclipse-jetty-0:9.4.40-1.1.el7_9 *
Red Hat Integration Camel Quarkus RedHat jetty *
Red Hat JBoss Fuse 7 RedHat jetty *
Red Hat OpenShift Container Platform 4.7 RedHat jenkins-0:2.277.3.1620393611-1.el8 *
Red Hat OpenShift Container Platform 4.7 RedHat runc-0:1.0.0-95.rhaos4.8.gitcd80260.el7 *
Equinox-bundles Ubuntu groovy *
Equinox-bundles Ubuntu hirsute *
Equinox-bundles Ubuntu trusty *

Potential Mitigations

  • Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

References