CVE-2019-10241

The vulnerability exists in the DefaultServlet and ResourceHandler components of Eclipse Jetty, which are used to serve static content and can be configured to display directory listings. When directory listing is enabled, a specially crafted URL can inject arbitrary HTML or JavaScript into the listing page, leading to cross-site scripting (XSS) [1]. The root cause is insufficient sanitization of user-supplied input in the URL path when generating the directory listing response.

An attacker can exploit this by sending a crafted request to a Jetty server where the directory listing feature is active. No authentication is required, and the attacker only needs network access to the server. The malicious URL contains HTML or script code that gets reflected in the listing page, allowing the attacker to execute scripts in the context of the victim's browser session.

Successful exploitation allows an attacker to steal cookies, session tokens, or other sensitive information, or perform actions on behalf of the victim. The impact is limited to the browser session of users viewing the directory listing, but can lead to credential theft or other client-side attacks.

Jetty versions 9.2.27, 9.3.26, and 9.4.16 contain the fix. Users should upgrade to these or later versions. No workaround is available if directory listing is required; however, disabling directory listing mitigates the vulnerability [2].