CVE-2020-1757: 
Java vulnerability analysis and mitigation

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass (NVD, Red Hat Bugzilla). The vulnerability was discovered by Fedorov Oleksii, Keitaro Yamazaki, and Shiga Ryota from LINE Corporation.

The vulnerability occurs when the servletPath is normalized by the Servlet container and truncated after the semicolon, leading to a partial servletPath. For example, a full path '/api/public/aa/secret' would result in a servletPath '/api/public/aa', leading to an application mapping '/secret'. The vulnerability has a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N (NVD).

This vulnerability can lead to a security bypass depending on where and how URL-based security is applied. The high CVSS score indicates significant potential impact on confidentiality and integrity of the affected systems (NVD).

The vulnerability requires network access and low privilege level to exploit, with no user interaction needed, as indicated by the CVSS vector string. No specific public exploits have been identified in the analyzed sources.

The issue can be mitigated by configuring UrlPathHelper to ignore the servletPath via setting 'alwaysUseFullPath'. For a permanent fix, users should upgrade to undertow-2.0.30.SP1 or undertow-2.1.0.Final or later versions (Red Hat Bugzilla).