CVE-2018-12536

Vulnerability

In Eclipse Jetty versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (all configurations), web applications deployed with the default error handling mechanism are vulnerable to an information disclosure issue. When a crafted HTTP query with malformed characters that does not match any servlet’s dynamic URL pattern is processed by the static file serving DefaultServlet, it causes a java.nio.file.InvalidPathException whose message includes the full filesystem path to the base resource directory used by the DefaultServlet or webapp [1][2].

Exploitation

An attacker requires no authentication and only needs network access to a vulnerable Jetty instance. The attacker sends an HTTP request with an intentionally malformed query string (e.g., containing non-printable or illegal characters) that fails to match any dynamic URL pattern. The request is eventually handled by the DefaultServlet for static file serving, where the malformed path triggers the InvalidPathException. This exception is then caught and processed by the default error handler, which includes the exception’s message (containing the full server path) in the HTTP error response [2].

Impact

A successful exploitation results in the disclosure of the full server filesystem path of the base resource directory used by the DefaultServlet or the deployed web application. This path disclosure aids an attacker in performing further reconnaissance and potentially chaining with other attacks, such as path traversal or local file inclusion [2][3]. No other direct impact on confidentiality, integrity, or availability has been reported from this specific flaw.

Mitigation

The vulnerability is fixed in Jetty versions 9.3.24.v20180605 and 9.4.11.v20180605 [2]. For version 9.2.x and older (which are end-of-life), no patch is provided and users are strongly advised to upgrade to a supported release. A workaround for versions that cannot be immediately patched is to avoid using the default error handler by implementing a custom error handler that does not expose the InvalidPathException or the underlying stack trace [1][2].