[FIXED] Jetty 9.4.38 exposes monitoredPath (contexts) as own context

Issue

i checked all configuration files and searched the jetty docs as well as github issues for this topic, but couldn't find any related information.

When running jetty 9.4.38 as standalone, it exposes the folder set as monitoredDir in etc/jetty-deploy.xml as an own context.

          <Arg>
            <New class="org.eclipse.jetty.deploy.providers.WebAppProvider">
              <Set name="monitoredDirName">
                <Property>
                  <Name>jetty.deploy.monitoredPath</Name>
                  <Default>
                    <Property name="jetty.base" default="." />/<Property name="jetty.deploy.monitoredDir" deprecated="jetty.deploy.monitoredDirName" default="contexts"/>  
                  </Default>
                </Property>
              </Set> 

from outside im able to access this context and then browse the files in the folder (context xmls...)

i can prohibit the file browsing by setting

<init-param>
      <param-name>dirAllowed</param-name>
      <param-value>false</param-value>
</init-param>

in etc/webdefaults.xml

but still I can access a file contained in the folder, if I know the path.

I would appreciate any hints on how to disable this context, so that it cannot be accessed from outside.

Solution

Upgrade your version of Jetty.

This was reported a while ago and was addressed in the fixes for CVE-2021-28163.

https://www.eclipse.org/jetty/security_reports.php

Answered By - Joakim Erdfelt
Answer Checked By - Marilyn (JavaFixing Volunteer)