CVE-2021-34429

This exploit demonstrates a path traversal vulnerability in Eclipse Jetty, allowing unauthorized access to sensitive files like WEB-INF/web.xml via a malformed URL request. The PoC shows a simple HTTP GET request with a Unicode-encoded dot to bypass security restrictions.

This repository provides a functional proof-of-concept for CVE-2021-34429, demonstrating how encoded URIs can bypass security restrictions in Eclipse Jetty 11.0.5 to access sensitive files in the WEB-INF directory. It includes a Docker setup for testing and a clear example of the exploit using a crafted GET request.

This Metasploit module exploits a path traversal vulnerability in Jetty to disclose files in the WEB-INF directory by using encoded URIs. It supports two CVEs (CVE-2021-34429 and CVE-2021-28164) and retrieves files like web.xml from vulnerable Jetty versions.