GHSA-m6cp-vxjx-65j6 CVE-2021-34428
SessionListener can prevent a session from being invalidated breaking logout
- Severity
- 3.5 / 10
- Low · CVSS 3.1
- Exploit chance (EPSS)
- 0.96%
- Chance of exploitation in the next 30 days. Higher than 61.68% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-613 Insufficient Session Expiration
- Fix
9.4.41- Upgrade org.eclipse.jetty:jetty-server to this version or later
Description
Impact
If an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
There is no known path for an attacker to induce such an exception to be thrown, thus they must rely on an application to throw such an exception. The OP has also identified that during the call to sessionDestroyed, the getLastAccessedTime() throws an IllegalStateException, which potentially contrary to the servlet spec, so applications calling this method may always throw and fail to log out. If such an application was only tested on a non clustered test environment, then it may be deployed on a clustered environment with multiple contexts and fail to log out.
Workarounds
The application should catch all Throwables within their SessionListener#sessionDestroyed() implementations.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.eclipse.jetty:jetty-server | < 9.4.41 |
9.4.41 |
| org.eclipse.jetty:jetty-server | >= 10.0.0, < 10.0.3 |
10.0.3 |
| org.eclipse.jetty:jetty-server | >= 11.0.0, < 11.0.3 |
11.0.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.eclipse.jetty:jetty-server Maven → 9.4.41
- maven
<dependency><groupId>org.eclipse.jetty</groupId><artifactId>jetty-server</artifactId><version>9.4.41</version></dependency>- gradle
implementation("org.eclipse.jetty:jetty-server:9.4.41")
Severity breakdown
CVSS 3.1 3.5
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Attack vector
- Physical
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-613: Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
How to prevent it
- Implementation: Set sessions/credentials expiration date.
References
Advisories
Other links
- github.com/eclipse/jetty.project/security/advisories/GHSA-m6cp-vxjx-65j6
- github.com/eclipse/jetty.project
- lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620e…
- lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb08…
- lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6f…
- lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d3545…
- lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc69…
- lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087…
- security.netapp.com/advisory/ntap-20210813-0003
- debian.org/security/2021/dsa-4949
- oracle.com/security-alerts/cpuapr2022.html
- oracle.com/security-alerts/cpujan2022.html
- oracle.com/security-alerts/cpuoct2021.html
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7p3p-8qv8-m2vh Eclipse Jetty: HTTP Authority/Host mismatch | Medium | Also affects org.eclipse.jetty:jetty-server |
| GHSA-f4v5-65jj-pcr2 Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections | High | Also affects org.eclipse.jetty:jetty-server |
| GHSA-9299-c6m4-mjhc Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests | High | Also affects org.eclipse.jetty:jetty-server |
| GHSA-xxh7-fcf3-rj7f The Eclipse Jetty Server Artifact has a Gzip request memory leak | High | Also affects org.eclipse.jetty:jetty-server |
| GHSA-q4rv-gq96-w7c5 **UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request | High | Also affects org.eclipse.jetty:jetty-server |
| GHSA-g8m5-722r-8whq Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks | Medium | Also affects org.eclipse.jetty:jetty-server |
| GHSA-p26g-97m4-6q7c Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies | Medium | Also affects org.eclipse.jetty:jetty-server |
| GHSA-qw69-rqj8-6qw8 OutOfMemoryError for large multipart without filename in Eclipse Jetty | Medium | Also affects org.eclipse.jetty:jetty-server |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor