CVE-2021-28164: 
Java vulnerability analysis and mitigation

CVE-2021-28164 affects Eclipse Jetty versions 9.4.37.v20210219 to 9.4.38.v20210224. The vulnerability allows requests with URIs containing %2e or %2e%2e segments to access protected resources within the WEB-INF directory, potentially exposing sensitive web application implementation details (GitHub Advisory, CVE Mitre).

The vulnerability stems from Jetty's default compliance mode implementation of RFC3986 regarding URI decoding. The implementation allows % encoded dot characters to be excluded from URI normalization, which while technically correct according to the RFC, differs from common Servlet implementation assumptions. For example, a request to /context/%2e/WEB-INF/web.xml can bypass protections and retrieve the web.xml file (GitHub Advisory).

When successfully exploited, this vulnerability can lead to the disclosure of sensitive information regarding the implementation of a web application. Specifically, attackers can access protected resources within the WEB-INF directory, which typically contains configuration files and other sensitive implementation details (GitHub Advisory, NetApp Advisory).

The vulnerability has a CVSS v3.1 base score of 2.7 (LOW), requiring high privileges but being exploitable over the network without user interaction. Proof-of-concept exploits have been publicly documented, demonstrating the ability to access WEB-INF resources through specifically crafted URI paths (NetApp Advisory).

A workaround is available by enabling the HttpCompliance mode RFC7230_NO_AMBIGUOUS_URIS in the start.d/http.ini configuration file. For permanent remediation, users should upgrade to Jetty version 9.4.39 or later which contains the fix for this vulnerability (GitHub Advisory, NetApp Advisory).