CVE-2021-34428

Vulnerability

In Eclipse Jetty versions <=9.4.40, <=10.0.2, and <=11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, the session ID is not invalidated in the session ID manager. This issue is particularly relevant on deployments with clustered sessions and multiple contexts, where the failure to invalidate can leave a session active [1][3].

Exploitation

There is no known path for an attacker to directly induce such an exception; exploitation relies on an application throwing an exception within its sessionDestroyed() implementation. Additionally, during the call to sessionDestroyed(), the getLastAccessedTime() method may throw an IllegalStateException, which is contrary to the Servlet specification and can cause logout failures in applications that were only tested in non-clustered environments [3].

Impact

A session that is not properly invalidated can result in an application used on a shared computer remaining logged in, potentially exposing sensitive data or allowing unauthorized access [1][3].

Mitigation

No fixed version has been disclosed in the available references. As a workaround, applications should catch all Throwable instances within their SessionListener#sessionDestroyed() implementations to prevent exceptions from breaking session invalidation [3].