CVE-2023-41900lowCWE-1390

CVE-2023-41900: low-severity vulnerability in eclipse jetty.project

Jetty's OpenId Revoked authentication allows one request

Published · Updated

Follow this CVE+ Monitor jetty.project+ Monitor jetty9

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.5epss 0.9%
In short

Jetty's OpenID authentication has a timing flaw where a user whose access was just revoked can still complete one more request as if they were authenticated before being logged out. This matters because an attacker with a revoked session could perform one unauthorized action.

Technical detail

The OpenIdAuthenticator in Jetty (versions 9.4.21–9.4.51, 10.0.15, 11.0.15) fails to immediately enforce LoginService revocation decisions. When a nested LoginService rejects a previously authenticated user, the current request is processed as authenticated before the session state is cleared, allowing one request to bypass the revocation check. Subsequent requests are properly denied.

Summary generated and translated by AI from the official description.
Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the `LoginService`. This impacts usages of the jetty-openid which have configured a nested `LoginService` and where that `LoginService` will is capable of rejecting previously authenticated users. Versions 9.4.52, 10.0.16, and 11.0.16 have a patch for this issue.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected products
eclipse · jetty.project
Related CVEs — eclipse jetty.project

In the same product, most dangerous first.

CVE-2023-36478HIGHHTTP/2 HPACK integer overflow and buffer allocationEPSS 4.8%CVE-2023-26048MEDIUMOutOfMemoryError for large multipart without filename in Eclipse JettyEPSS 3.4%CVE-2023-26049LOWCookie parsing of quoted values can exfiltrate values from other cookies in Eclipse JettyEPSS 1.3%CVE-2023-40167MEDIUMJetty accepts "+" prefixed value in Content-LengthEPSS 1.3%CVE-2023-36479LOWJetty vulnerable to errant command quoting in CGI ServletEPSS 1.2%