CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
15.5%
Eclipse Jetty is prone to a denial of service (DoS)
vulnerability.
# SPDX-FileCopyrightText: 2024 Greenbone AG
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-only
CPE = "cpe:/a:eclipse:jetty";
if(description)
{
script_oid("1.3.6.1.4.1.25623.1.0.151837");
script_version("2024-06-11T05:05:40+0000");
script_tag(name:"last_modification", value:"2024-06-11 05:05:40 +0000 (Tue, 11 Jun 2024)");
script_tag(name:"creation_date", value:"2024-02-27 02:43:50 +0000 (Tue, 27 Feb 2024)");
script_tag(name:"cvss_base", value:"7.8");
script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:N/I:N/A:C");
script_cve_id("CVE-2024-22201");
script_tag(name:"qod_type", value:"remote_banner");
script_tag(name:"solution_type", value:"VendorFix");
script_name("Eclipse Jetty DoS Vulnerability (GHSA-rggv-cv7r-mw98) - Windows");
script_category(ACT_GATHER_INFO);
script_copyright("Copyright (C) 2024 Greenbone AG");
script_family("Web Servers");
script_dependencies("gb_jetty_http_detect.nasl", "os_detection.nasl");
script_mandatory_keys("jetty/detected", "Host/runs_windows");
script_tag(name:"summary", value:"Eclipse Jetty is prone to a denial of service (DoS)
vulnerability.");
script_tag(name:"vuldetect", value:"Checks if a vulnerable version is present on the target host.");
script_tag(name:"insight", value:"If an HTTP/2 connection gets TCP congested, when an idle
timeout occurs the HTTP/2 session is marked as closed, and then a GOAWAY frame is queued to be
written. However it is not written because the connection is TCP congested. When another idle
timeout period elapses, it is then supposed to hard close the connection, but it delegates to the
HTTP/2 session which reports that it has already been closed so it does not attempt to hard close
the connection.
This leaves the connection in ESTABLISHED state (i.e. not closed), TCP congested, and idle.
An attacker can cause many connections to end up in this state, and the server may run out of
file descriptors, eventually causing the server to stop accepting new connections from valid
clients.");
script_tag(name:"affected", value:"Eclipse Jetty version 9.3.0 through 9.4.53, 10.0.0 through
10.0.19, 11.0.0 through 11.0.19 and 12.0.0 through 12.0.5.");
script_tag(name:"solution", value:"Update to version 9.4.54, 10.0.20, 11.0.20, 12.0.6 or later.");
script_xref(name:"URL", value:"https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98");
exit(0);
}
include("host_details.inc");
include("version_func.inc");
if (!port = get_app_port(cpe: CPE))
exit(0);
if (!infos = get_app_version_and_location(cpe: CPE, port: port, exit_no_version: TRUE))
exit(0);
version = infos["version"];
location = infos["location"];
if (version_in_range_exclusive(version: version, test_version_lo: "9.3.0", test_version_up: "9.4.54")) {
report = report_fixed_ver(installed_version: version, fixed_version: "9.4.54", install_path: location);
security_message(port: port, data: report);
exit(0);
}
if (version_in_range_exclusive(version: version, test_version_lo: "10.0.0", test_version_up: "10.0.20")) {
report = report_fixed_ver(installed_version: version, fixed_version: "10.0.20", install_path: location);
security_message(port: port, data: report);
exit(0);
}
if (version_in_range_exclusive(version: version, test_version_lo: "11.0.0", test_version_up: "11.0.20")) {
report = report_fixed_ver(installed_version: version, fixed_version: "11.0.20", install_path: location);
security_message(port: port, data: report);
exit(0);
}
if (version_in_range_exclusive(version: version, test_version_lo: "12.0.0", test_version_up: "12.0.6")) {
report = report_fixed_ver(installed_version: version, fixed_version: "12.0.6", install_path: location);
security_message(port: port, data: report);
exit(0);
}
exit(99);
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
15.5%