CVE-2017-7656

Vulnerability

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x in non-default configuration with RFC2616 compliance enabled, HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e., method space URI space version) that declares a version of HTTP/0.9 is accepted and treated as a 0.9 request [1][3]. This means the server responds without HTTP status line or headers, sending only the entity body. Affected versions include Jetty <= 9.3.23.v20180228 and >= 9.4.0 through <= 9.4.10.v20180503 [3].

Exploitation

An attacker must be able to send requests through an intermediary (such as a reverse proxy or cache) that also accepts and passes through HTTP/0.9 version but does not act on it (i.e., it forwards the request as-is) [1]. The attacker sends a crafted request with a line such as GET / HTTP/0.9 to the origin Jetty server. Since Jetty treats this as an HTTP/0.9 request, it responds with raw content (no HTTP headers). The intermediary, expecting an HTTP/1 response, may misinterpret this raw content from Jetty as HTTP/1 headers, thereby allowing the attacker to inject arbitrary headers into the response seen by the next client [1][2]. No authentication is required; the attack is performed over the network.

Impact

If the server allows the origin client to generate arbitrary content in the response (i.e., the attacker can control parts of the response body), the attacker can poison the cache of the intermediary [1]. This can lead to stored cross-site scripting (XSS) or other attacks against users who subsequently receive the cached malicious response. The confidentiality, integrity, and availability of the system may be compromised, depending on the cache's role.

Mitigation

For versions 9.3.x, upgrade to 9.3.24.v20180605 or later; for 9.4.x, upgrade to 9.4.11.v20180605 or later [3]. The Jetty bug tracker confirms the fix was applied [2]. Administrators should also ensure that intermediaries (reverse proxies, caches) block or sanitize HTTP/0.9 requests, or disable RFC2616 compliance in Jetty configurations to avoid the vulnerable code path.