CVE-2017-7658
📋 TL;DR
CVE-2017-7658 is a critical HTTP request smuggling vulnerability in Eclipse Jetty that allows attackers to bypass authorization controls. When Jetty receives conflicting Content-Length headers or mixed Content-Length and Transfer-Encoding headers, it can misinterpret request boundaries, enabling attackers to inject unauthorized requests. This affects Jetty versions 9.2.x and older, 9.3.x with non-HTTP/1.x configurations, and 9.4.x with HTTP/1.x configurations.
💻 Affected Systems
- Eclipse Jetty
📦 What is this software?
E Series Santricity Os Controller by Netapp
E Series Santricity Web Services by Netapp
Jetty by Eclipse
Jetty by Eclipse
Jetty by Eclipse
Oncommand Unified Manager For 7 Mode by Netapp
View all CVEs affecting Oncommand Unified Manager For 7 Mode →
Solidfire by Netapp
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through authorization bypass leading to data exfiltration, privilege escalation, or remote code execution depending on application functionality.
Likely Case
Unauthorized access to protected resources, data manipulation, or privilege escalation by bypassing authentication/authorization mechanisms.
If Mitigated
Limited impact if proper network segmentation, WAF filtering, and strict access controls are implemented.
🎯 Exploit Status
Exploitation requires understanding of HTTP request smuggling techniques and the ability to send malformed HTTP requests. Public proof-of-concept code exists in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Jetty 9.2.25.v20180606, 9.3.24.v20180605, 9.4.8.v20171121
Vendor Advisory: https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
Restart Required: Yes
Instructions:
1. Identify current Jetty version. 2. Upgrade to patched version: 9.2.25+, 9.3.24+, or 9.4.8+. 3. Restart Jetty server. 4. Verify fix by testing with malformed HTTP headers.
🔧 Temporary Workarounds
WAF Configuration
allConfigure Web Application Firewall to reject requests with multiple Content-Length headers or mixed Content-Length/Transfer-Encoding headers.
Reverse Proxy Filtering
allConfigure reverse proxies (nginx, Apache, HAProxy) to normalize or reject malformed HTTP requests before they reach Jetty.
🧯 If You Can't Patch
- Deploy WAF with rules to detect and block HTTP request smuggling attempts
- Implement network segmentation to limit access to vulnerable Jetty instances
🔍 How to Verify
Check if Vulnerable:
Check Jetty version and configuration. Versions 9.2.x ≤ 9.2.24, 9.3.x ≤ 9.3.23, or 9.4.x ≤ 9.4.7 with vulnerable configurations are affected.Check Version:
java -jar jetty-distribution-*.jar --version or check server startup logsVerify Fix Applied:
After patching, test with tools like smuggler.py or manually send requests with duplicate Content-Length headers to verify they are rejected.📡 Detection & Monitoring
Log Indicators:
- Multiple Content-Length headers in single request
- Mixed Content-Length and Transfer-Encoding headers
- Unexpected 400/413 errors
Network Indicators:
- HTTP requests with duplicate headers
- Abnormal request/response timing patterns
SIEM Query:
http.headers:"Content-Length" AND count>1 OR (http.headers:"Content-Length" AND http.headers:"Transfer-Encoding")🔗 References
- http://www.securityfocus.com/bid/106566
- http://www.securitytracker.com/id/1041194
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3E
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
- https://www.debian.org/security/2018/dsa-4278
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- http://www.securityfocus.com/bid/106566
- http://www.securitytracker.com/id/1041194
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae%40%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574%40%3Ccommits.druid.apache.org%3E
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
- https://www.debian.org/security/2018/dsa-4278
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
