CVE-2019-17632

Vulnerability

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the default ErrorHandler generates error responses in text/html and text/json content types without escaping exception messages in the included stacktraces [1][2]. This oversight allows malicious exception messages to be injected directly into the response.

Exploitation

An attacker can exploit this by submitting a request that triggers an exception containing a crafted payload, such as JavaScript code. When the error response is rendered in a browser, the unescaped payload executes, enabling cross-site scripting (XSS) attacks. No authentication is required, as Jetty's default error handling applies to unhandled exceptions from any request [2].

Impact

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the user's browser session, potentially leading to data theft, session hijacking, or other malicious actions. This vulnerability has been assigned a CVSS score of 6.1 (Medium) [1].

Mitigation

The issue is fixed in Jetty version 9.4.24.v20191120 [2]. As a workaround, administrators can disable stacktraces in the ErrorHandler by setting showStacks to false at the Server or WebAppContext level [2].