Jetty vulnerable to errant command quoting in CGI Servlet

Summary

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This issue was patched in version 9.4.52, 10.0.16, 11.0.16 and 12.0.0-beta2.

Timeline

1. Sep 15, 2023, 6:37 PM UTCCVE published
2. Sep 25, 2024, 3:04 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jun 18, 2025, 2:41 PM UTCRecord last updated

Affected versions

• eclipse jetty.project

  From 9.0.0 · through 9.4.51; From 10.0.0 · through 10.0.15; From 11.0.0 · through 11.0.15; through 12.0.0-beta1

• org.eclipse.jetty:jetty-servletsMaven

  From 9.0.0 · fixed in 9.4.52

• org.eclipse.jetty:jetty-servletsMaven

  From 10.0.0 · fixed in 10.0.16

• org.eclipse.jetty:jetty-servletsMaven

  From 11.0.0 · fixed in 11.0.16

• org.eclipse.jetty.ee10:jetty-ee10-servletsMaven

  fixed in 12.0.0-beta2

• org.eclipse.jetty.ee9:jetty-ee9-servletsMaven

  fixed in 12.0.0-beta2

• org.eclipse.jetty.ee8:jetty-ee8-servletsMaven

  fixed in 12.0.0-beta2

References 6