CVE-2017-7658
published 2018-06-26CVE-2017-7658: In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
20.98%
97.3th percentile
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | jetty9 | < jetty9 9.2.25-1 (bookworm) | jetty9 9.2.25-1 (bookworm) |
| eclipse | jetty | <= 9.2.26 | — |
| eclipse | jetty | >= 9.3.0 < 9.3.24 | 9.3.24 |
| eclipse | jetty | >= 9.4.0 < 9.4.11 | 9.4.11 |
| hp | xp_p9000_command_view | 8.4.0-00 – 8.6.2-00 | — |
| netapp | e-series_santricity_os_controller | 11.0 – 11.50.1 | — |
| netapp | oncommand_system_manager | 3.0 – 3.1.3 | — |
| oracle | rest_data_services | — | — |
| oracle | rest_data_services | — | — |
| oracle | rest_data_services | — | — |
| oracle | rest_data_services | — | — |
| oracle | retail_xstore_payment | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| oracle | retail_xstore_point_of_service | — | — |
| the_eclipse_foundation | eclipse_jetty | >= 9.3.0 < unspecified | unspecified |
| the_eclipse_foundation | eclipse_jetty | >= 9.4.0 < unspecified | unspecified |
| the_eclipse_foundation | eclipse_jetty | >= unspecified < 9.2.25 | 9.2.25 |
| the_eclipse_foundation | eclipse_jetty | >= unspecified < 9.3.24 | 9.3.24 |
| the_eclipse_foundation | eclipse_jetty | >= unspecified < 9.4.11 | 9.4.11 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect HTTP requests with both a Content-Length header and a Transfer-Encoding: chunked header sent to Jetty servers — this dual-header pattern is the core smuggling vector for CVE-2017-7658 ↗
- →Detect HTTP requests with two distinct Content-Length headers targeting Jetty — Jetty silently drops the second value, enabling request smuggling when a front-end proxy honours the shorter one ↗
- →Flag pipelined HTTP requests arriving at Jetty that originate from an intermediary/reverse-proxy, especially where the body length exceeds the Content-Length value declared by the proxy — the excess bytes are treated as a new pipelined request, potentially bypassing authorization ↗
- ·CVE-2017-7658 affects Jetty 9.2.x and older unconditionally; 9.3.x only in non-HTTP/1.x configurations; and 9.4.x only in HTTP/1.x configurations — scope detection rules accordingly ↗
- ·The vulnerability is exploitable only when Jetty sits behind an intermediary (reverse proxy, load balancer) that enforces authorization — direct exposure without an intermediary does not enable the authorization-bypass primitive ↗
- ·Red Hat Data Grid 7's agent-bond utility is the affected component in that product; it is deprecated and disabled by default — detection should target environments where agent-bond is explicitly enabled ↗
- ·Debian fixed the vulnerability in jetty package version 9.2.25-1 across all supported releases — use package version checks to confirm patched state ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8LOW
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
ghsa·2018-10-19
CVE-2017-7658 [CRITICAL] CWE-444 Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
Eclipse Jetty Server versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), are vulnerable to HTTP Request Smuggling when presented with two content-lengths headers, allowing authorization bypass. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decides on the shorter length, but still passes on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary is imposing authorization, the fake pipelined request bypasses that authorization.
OSV
Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
osv·2018-10-19
CVE-2017-7658 [CRITICAL] Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
Eclipse Jetty Server versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), are vulnerable to HTTP Request Smuggling when presented with two content-lengths headers, allowing authorization bypass. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decides on the shorter length, but still passes on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary is imposing authorization, the fake pipelined request bypasses that authorization.
OSV
CVE-2017-7658: In Eclipse Jetty Server, versions 9
osv·2018-06-26·CVSS 9.8
CVE-2017-7658 [CRITICAL] CVE-2017-7658: In Eclipse Jetty Server, versions 9
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Oracle
Oracle Oracle REST Data Services Risk Matrix: General (Eclipse Jetty) — CVE-2017-7658
vendor_oracle·2020-10-15·CVSS 9.8
CVE-2017-7658 [CRITICAL] Oracle Oracle REST Data Services Risk Matrix: General (Eclipse Jetty) — CVE-2017-7658
Oracle Oracle REST Data Services Risk Matrix: General (Eclipse Jetty) vulnerability
CVE: CVE-2017-7658
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2020 (OCT 2020)
Red Hat
jetty: Incorrect header handling
vendor_redhat·2018-06-07·CVSS 9.8
CVE-2017-7658 [CRITICAL] CWE-444 jetty: Incorrect header handling
jetty: Incorrect header handling
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Statement: This issue affects the versions of jetty embedded in the nutch package as shipped with Red Hat Satellite 5. The nutch service is not exposed, as such exploitatio
Debian
CVE-2017-7658: jetty9 - In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x confi...
vendor_debian·2017·CVSS 9.8
CVE-2017-7658 [CRITICAL] CVE-2017-7658: jetty9 - In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x confi...
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Scope: local
bookworm: resolved (fixed in 9.2.25-1)
bullseye: resolved (fixed in 9.2.25-1)
forky: resolved (fixed in 9.2.25-1)
sid: resolved (fixed in 9.2.25-1)
trixie: resolved (fixed in 9.2.25-1)
No detection rules found.
No public exploits indexed.
HackerOne
Multiple HTTP Smuggling reports
hackerone·2019-11-12·CVSS 9.8
[CRITICAL] Multiple HTTP Smuggling reports
Multiple HTTP Smuggling reports
Theses reports spreads other several years and are all about **HTTP Smuggling issues**
(HTTP Requests or Responses splitting, Cache Poisoning, Security filter bypass).
I've made reports on a wide range of open source projects, explaining
the (not always easy) problems to the various security maintainers and testing the fixs.
The starting point for this work was the 2005 work published by Amit Klein and some others:
* 2004 - Amit Klein : "Divide and Conquer: HTTP Response Splitting, Web Cache Poisoning Attacks, and Related Topics" https://packetstormsecurity.com/papers/general/whitepaper_httpresponse.pdf
* 2005 - Chaim Linhart, Amit Klein, Ronen Heled, Steve Orrin: "HTTP Request Smuggling" https://www.cgisecurity.com/lib/HTTP-Request-Smuggling.pdf
* 2006 -
Bugzilla
CVE-2017-7658 jetty: Incorrect header handling
bugzilla·2018-06-27·CVSS 9.8
CVE-2017-7658 [CRITICAL] CVE-2017-7658 jetty: Incorrect header handling
CVE-2017-7658 jetty: Incorrect header handling
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Upstream issue:
https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
Discussion:
Created jetty tracking bugs for this issue:
Affects: fedora-all [bug 1595
Bugzilla
CVE-2017-7656 CVE-2017-7657 CVE-2017-7658 jetty: various flaws [fedora-all]
bugzilla·2018-06-27·CVSS 7.5
CVE-2017-7656 [HIGH] CVE-2017-7656 CVE-2017-7657 CVE-2017-7658 jetty: various flaws [fedora-all]
CVE-2017-7656 CVE-2017-7657 CVE-2017-7658 jetty: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions o
http://www.securityfocus.com/bid/106566http://www.securitytracker.com/id/1041194https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20181014-0001/https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_ushttps://www.debian.org/security/2018/dsa-4278https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlhttp://www.securityfocus.com/bid/106566http://www.securitytracker.com/id/1041194https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3Ehttps://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3Ehttps://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3Ehttps://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3Ehttps://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3Ehttps://security.netapp.com/advisory/ntap-20181014-0001/https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_ushttps://www.debian.org/security/2018/dsa-4278https://www.oracle.com//security-alerts/cpujul2021.htmlhttps://www.oracle.com/security-alerts/cpuoct2020.htmlhttps://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.htmlhttps://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
2018-06-26
Published