Security bypass in Jetty - CVE-2016-4800

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to an error within PathResource class when parsing URLs, which contains certain escaped characters. A remote unauthenticated attacker can bypass implemented security restrictions and gain access to protected resources (e.g. WEB-INF and META-INF folders and their contents) or bypass application filters or other restrictions, implemented in servlet configuration.

Successful exploitation of the vulnerability may allow an attacker to gain unauthorized access to otherwise protected resources.

How to mitigate CVE-2016-4800

Sources

• https://www.eclipse.org/jetty/documentation/9.4.x/security-reports.html
• http://www.ocert.org/advisories/ocert-2016-001.html