CVE-2017-7657

Vulnerability

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), the transfer-encoding chunk length parsing is vulnerable to an integer overflow [1]. This flaw causes a large chunk size to be misinterpreted as a smaller one, allowing the chunk body to be treated as a pipelined HTTP request [2].

Exploitation

An attacker requires a specific intermediary that imposes authorization but allows arbitrarily large chunks to pass unchanged. By crafting a chunked transfer-encoding message with an oversized chunk length, the attacker can trigger the overflow, resulting in a pipelined request that the intermediary does not recognize as a request, thus bypassing its authorization [1][2].

Impact

Successful exploitation could allow HTTP request smuggling, leading to authorization bypass and potential access to restricted resources. The impact can be significant as the intermediary's security controls are circumvented [2].

Mitigation

Fixed versions are available: 9.2.25.v20180606, 9.3.24.v20180605, and 9.4.11.v20180605 [2][4]. For 9.4.x, disabling RFC2616 compliance (non-default) also mitigates the issue. Users should upgrade to the latest patched version or apply the configuration change [1].