CVE-2023-36479
published 2023-09-15CVE-2023-36479: Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have…
PriorityP414low3.1CVSS 3.1
AVNACHPRLUINSUCNILAN
EPSS
1.01%
59.2th percentile
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | jetty9 | < jetty9 9.4.50-4+deb12u1 (bookworm) | jetty9 9.4.50-4+deb12u1 (bookworm) |
| eclipse | jetty | — | — |
| eclipse | jetty | >= 10.0.0 < 10.0.16 | 10.0.16 |
| eclipse | jetty | >= 11.0.0 < 11.0.16 | 11.0.16 |
| eclipse | jetty | >= 9.0.0 < 9.4.52 | 9.4.52 |
| eclipse | jetty.project | <= 12.0.0-beta1 | — |
| eclipse | jetty.project | — | — |
| eclipse | jetty.project | — | — |
| eclipse | jetty.project | — | — |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
osv3.1LOW
vendor_debian3.5LOW
vendor_redhat3.5LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-36479: Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project
osv·2023-09-15·CVSS 3.1
CVE-2023-36479 [LOW] CVE-2023-36479: Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
OSV
Jetty vulnerable to errant command quoting in CGI Servlet
osv·2023-09-14
CVE-2023-36479 [LOW] Jetty vulnerable to errant command quoting in CGI Servlet
Jetty vulnerable to errant command quoting in CGI Servlet
If a user sends a request to a `org.eclipse.jetty.servlets.CGI` Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. For example, if a request references a binary called file” name “here, the escaping algorithm will generate the command line string “file” name “here”, which will invoke the binary named file, not the one that the user requested.
```java
if (execCmd.length() > 0 && execCmd.charAt(
GHSA
Jetty vulnerable to errant command quoting in CGI Servlet
ghsa·2023-09-14
CVE-2023-36479 [LOW] CWE-149 Jetty vulnerable to errant command quoting in CGI Servlet
Jetty vulnerable to errant command quoting in CGI Servlet
If a user sends a request to a `org.eclipse.jetty.servlets.CGI` Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. For example, if a request references a binary called file” name “here, the escaping algorithm will generate the command line string “file” name “here”, which will invoke the binary named file, not the one that the user requested.
```java
if (execCmd.length() > 0 && execCmd.charAt(
Red Hat
jetty: Improper addition of quotation marks to user inputs in CgiServlet
vendor_redhat·2023-09-19·CVSS 3.5
CVE-2023-36479 [LOW] CWE-149 jetty: Improper addition of quotation marks to user inputs in CgiServlet
jetty: Improper addition of quotation marks to user inputs in CgiServlet
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
A fla
Debian
CVE-2023-36479: jetty9 - Eclipse Jetty Canonical Repository is the canonical repository for the Jetty pro...
vendor_debian·2023·CVSS 3.5
CVE-2023-36479 [LOW] CVE-2023-36479: jetty9 - Eclipse Jetty Canonical Repository is the canonical repository for the Jetty pro...
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.
Scope: local
bookworm: resolved (fixed in 9.4.50-4+deb12u1)
bullseye: resolved (
No detection rules found.
No public exploits indexed.
Trailofbits
Securing open-source infrastructure with OSTIF
blogs_trailofbits·2024-01-09
Securing open-source infrastructure with OSTIF
The Open Source Technology Improvement Fund (OSTIF) counters an often overlooked challenge in the open-source world: the same software projects that uphold today’s internet infrastructure are reliant on, in OSTIF’s words, a “surprisingly small group of people with a limited amount of time” for all development, testing, and maintenance.
This scarcity of contributor time in the open-source community is a well-known problem, and it renders the internet’s critical infrastructure vulnerable. To quote OSTIF, “because of the lack of a profit motive, core open-source projects are woefully underfunded and their resources are lacking. This leaves crucial Internet infrastructure susceptible to bugs, poor documentation, poor performance, slow release schedules, and even espionage.”
We couldn’t agree
Trailofbits
Securing open-source infrastructure with OSTIF
blogs_trailofbits·2024-01-09
Securing open-source infrastructure with OSTIF
The Open Source Technology Improvement Fund (OSTIF) counters an often overlooked challenge in the open-source world: the same software projects that uphold today’s internet infrastructure are reliant on, in OSTIF’s words, a “surprisingly small group of people with a limited amount of time” for all development, testing, and maintenance.
This scarcity of contributor time in the open-source community is a well-known problem, and it renders the internet’s critical infrastructure vulnerable. To quote OSTIF, “because of the lack of a profit motive, core open-source projects are woefully underfunded and their resources are lacking. This leaves crucial Internet infrastructure susceptible to bugs, poor documentation, poor performance, slow release schedules, and even espionage.”
We couldn’t agree
https://github.com/eclipse/jetty.project/pull/9516https://github.com/eclipse/jetty.project/pull/9888https://github.com/eclipse/jetty.project/pull/9889https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9jhttps://lists.debian.org/debian-lts-announce/2023/09/msg00039.htmlhttps://www.debian.org/security/2023/dsa-5507https://github.com/eclipse/jetty.project/pull/9516https://github.com/eclipse/jetty.project/pull/9888https://github.com/eclipse/jetty.project/pull/9889https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9jhttps://lists.debian.org/debian-lts-announce/2023/09/msg00039.htmlhttps://www.debian.org/security/2023/dsa-5507
2023-09-15
Published