cbcvebase.
CVE-2021-34429
published 2021-07-15

CVE-2021-34429: For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF…

PriorityP180medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
99.30%
99.9th percentile
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Affected

17 ranges
VendorProductVersion rangeFixed in
debianjetty9< jetty9 9.4.39-3 (bookworm)jetty9 9.4.39-3 (bookworm)
eclipsejetty>= 10.0.1 < 10.0.610.0.6
eclipsejetty>= 11.0.1 < 11.0.611.0.6
eclipsejetty>= 9.4.37 < 9.4.439.4.43
netappe-series_santricity_os_controller11.0 – 11.70.1
oracleautovue_for_agile_product_lifecycle_management
oraclecommunications_cloud_native_core_binding_support_function
oraclecommunications_cloud_native_core_security_edge_protection_proxy
oraclecommunications_cloud_native_core_service_communication_proxy
oraclecommunications_cloud_native_core_unified_data_repository
oraclecommunications_diameter_signaling_router8.0.0.0 – 8.5.0.2
oraclefinancial_services_crime_and_compliance_management_studio
oraclefinancial_services_crime_and_compliance_management_studio
oraclerest_data_services< 22.1.122.1.1
oracleretail_eftlink
oraclestream_analytics< 19.1.0.0.6.419.1.0.0.6.4
oraclestream_analytics

Detection & IOCsextracted from sources · hover to see the quote

url/%u002e/WEB-INF/web.xml
url/.%00/WEB-INF/web.xml
path/WEB-INF/web.xml
  • Detect exploitation attempts by monitoring HTTP requests containing encoded traversal sequences targeting WEB-INF: look for `%u002e` (Unicode-encoded dot) or `.%00` (null-byte dot) in URI paths, specifically paths resolving to `/WEB-INF/`.
  • The Metasploit auxiliary module `auxiliary/gather/jetty_web_inf_disclosure` can be used to validate exposure; monitor for its characteristic request patterns against `/WEB-INF/` paths.
  • ·Affected versions are specifically 9.4.37–9.4.42, 10.0.1–10.0.5, and 11.0.1–11.0.5; detections should be scoped to these Jetty version ranges to reduce false positives.
  • ·This is a variation of CVE-2021-28164; environments that patched CVE-2021-28164 may still be vulnerable if not updated to versions beyond the affected ranges listed above.
  • ·The nuclei template uses `unsafe: true` mode because the exploit payloads include raw encoded characters (`%u002e`, `.%00`) that standard HTTP clients may normalize before sending, bypassing the vulnerability trigger.

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
ghsa5.3MEDIUM
osv5.3MEDIUM
vulncheck5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_oracle5.3MEDIUM
vendor_redhat5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.