CVE-2021-34429

MEDIUM EXPLOITED NUCLEI LAB

Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5, 11.0.1-11.0.5 - Directory Traversal & Security Bypass via Encoded URI

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-34429 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including Mayank Deshmukh, ColdFusionX, h00die, Mayank Deshmukh, cangqingzhe, lachlan roberts <[email protected]>, charlesk40, including a Metasploit module auxiliary/gather/jetty_web_inf_disclosure. A Nuclei detection template is also available.

AI-analyzed exploit summary This exploit demonstrates a path traversal vulnerability in Eclipse Jetty, allowing unauthorized access to sensitive files like WEB-INF/web.xml via a malformed URL request. The PoC shows a simple HTTP GET request with a Unicode-encoded dot to bypass security restrictions.

Description

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Exploits (3)

exploitdb WORKING POC
by Mayank Deshmukh · textwebappsjava
https://www.exploit-db.com/exploits/50478

This exploit demonstrates a path traversal vulnerability in Eclipse Jetty, allowing unauthorized access to sensitive files like WEB-INF/web.xml via a malformed URL request. The PoC shows a simple HTTP GET request with a Unicode-encoded dot to bypass security restrictions.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Eclipse Jetty (9.4.37 ≤ version < 9.4.43, 10.0.1 ≤ version < 10.0.6, 11.0.1 ≤ version < 11.0.6)
No auth needed
Prerequisites: Network access to the target Jetty server
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 6 stars
by ColdFusionX · poc
https://github.com/ColdFusionX/CVE-2021-34429

This repository provides a functional proof-of-concept for CVE-2021-34429, demonstrating how encoded URIs can bypass security restrictions in Eclipse Jetty 11.0.5 to access sensitive files in the WEB-INF directory. It includes a Docker setup for testing and a clear example of the exploit using a crafted GET request.

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Eclipse Jetty 11.0.5
No auth needed
Prerequisites: Docker and Docker Compose installed · Jetty 11.0.5 running
devstral-2 · analyzed Feb 18, 2026 Full analysis →
metasploit WORKING POC
by h00die, Mayank Deshmukh, cangqingzhe, lachlan roberts <[email protected]>, charlesk40 · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/jetty_web_inf_disclosure.rb

This Metasploit module exploits a path traversal vulnerability in Jetty to disclose files in the WEB-INF directory by using encoded URIs. It supports two CVEs (CVE-2021-34429 and CVE-2021-28164) and retrieves files like web.xml from vulnerable Jetty versions.

Classification
Working Poc 100%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: Jetty (versions 9.4.37-9.4.42, 10.0.1-10.0.5, 11.0.1-11.0.5)
No auth needed
Prerequisites: Network access to the Jetty server · Vulnerable Jetty version
devstral-2 · analyzed Apr 16, 2026 Full analysis →

Nuclei Templates (1)

Eclipse Jetty - Information Disclosure
MEDIUMby bernardofsr,am0nt31r0
Shodan: cpe:"cpe:2.3:a:eclipse:jetty"

References (38)

Core 38
Core References
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujan2022.html
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210819-0006/
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpuapr2022.html
Patch, Third Party Advisory x_refsource_misc
https://www.oracle.com/security-alerts/cpujul2022.html

Scores

CVSS v3 5.3
EPSS 0.9378
EPSS Percentile 99.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Lab Environment

COMMUNITY
Community Lab
docker pull jetty:11.0.5

Details

VulnCheck KEV 2023-01-12
CWE
CWE-551 CWE-200
Status published
Products (21)
eclipse/jetty 9.4.37 - 9.4.43
netapp/e-series_santricity_os_controller 11.0 - 11.70.1
netapp/e-series_santricity_web_services
netapp/element_plug-in_for_vcenter_server
netapp/hci_management_node
netapp/snap_creator_framework
netapp/snapcenter_plug-in
netapp/solidfire
oracle/autovue_for_agile_product_lifecycle_management 21.0.2
oracle/communications_cloud_native_core_binding_support_function 1.10.0
... and 11 more
Published Jul 15, 2021
Tracked Since Feb 18, 2026