Описание
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
A flaw was found in Eclipse Jetty. The JASPIAuthenticator class is responsible for handling authentication checks. During these checks, the class sets two ThreadLocal variables to store authentication state. Under certain conditions, the authentication process can return early without properly clearing the ThreadLocal variables, allowing a subsequent request to inherit the un-cleared ThreadLocal values. This issue can cause broken access control, authentication bypass, privilege escalation and data breaches.
Отчет
This vulnerability is only exploitable when JASPIAuthenticator class returns early and a subsequent request inherits the un-cleared ThreadLocal values. This requires a new request to be assigned the exact same recycled thread, increasing the complexity of exploitation. Due to these reasons, this flaw has been rated with an important severity.
Меры по смягчению последствий
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Data Grid 8 | jetty-ee10-servlet | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | jetty-ee10-annotations | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | jetty-ee10-apache-jsp | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | jetty-ee10-cdi | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | jetty-ee10-fcgi-proxy | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | jetty-ee10-glassfish-jstl | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | jetty-ee10-home | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | jetty-ee10-jaspi | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | jetty-ee10-jndi | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 8 | jetty-ee10-jspc-maven-plugin | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.4 High
CVSS3
Связанные уязвимости
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentic ...
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
EPSS
7.4 High
CVSS3