CVE-2020-27216: 
Java vulnerability analysis and mitigation

CVE-2020-27216 affects Eclipse Jetty versions 1.0 through 9.4.32.v20200930, 10.0.0.alpha1 through 10.0.0.beta2, and 11.0.0.alpha1 through 11.0.0.beta2. The vulnerability was discovered in October 2020 and disclosed by security researcher Jonathan Leitschuh (Eclipse Bug, GitHub Advisory).

The vulnerability exists in Unix-like systems where the system's temporary directory is shared between all users. A collocated user can observe the process of creating a temporary subdirectory in the shared temporary directory and race to complete the creation before Jetty. The vulnerability has a CVSS v3.1 score of 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

If an attacker wins the race condition, they gain read and write permissions to the subdirectory used to unpack web applications, including access to WEB-INF/lib jar files and JSP files. If any code is executed from this temporary directory, this can lead to local privilege escalation. The vulnerability also affects any user code using WebAppContext::getTempDirectory or ServletContext tempdir attributes (GitHub Advisory).

The vulnerability requires local access and can be exploited through a race condition attack on temporary directory creation. The JSP library itself uses the container temp directory for compiling JSP source into Java classes before executing them, making it a potential attack vector (GitHub Advisory).

The vulnerability was patched in versions 9.4.33, 10.0.0.beta3, and 11.0.0.beta3. A workaround is to set a temporary directory, either for the server or the context, to a directory outside of the shared temporary file system. For recent releases, creating a 'work' directory in ${jetty.base} or setting java.io.tmpdir to a secure location can mitigate the issue (GitHub Advisory).

The vulnerability received attention from multiple organizations including Oracle, NetApp, and Debian who issued security advisories and patches for their affected products (Oracle CPU, NetApp Advisory).