Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-2047

CVE-2022-2047: Jetty invalid URI parsing may produce invalid HttpURI.authority

2.7

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-2047
GHSA ID
GHSA-cj7v-27pg-wf7q
EPSS Score
0.73391%
CWE
CWE-20
Published
7/7/2022
Updated
1/29/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.eclipse.jetty:jetty-httpmaven< 9.4.479.4.47
org.eclipse.jetty:jetty-httpmaven>= 10.0.0, < 10.0.1010.0.10
org.eclipse.jetty:jetty-httpmaven>= 11.0.0, < 11.0.1011.0.10

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper input validation in HttpURI's authority parsing. The advisory specifically calls out incorrect host parsing for URIs like 'http://localhost;/path'. The core issue must exist in the authority parsing workflow:

  1. parseAuthority() would be responsible for splitting userinfo/host/port components
  2. setAuthority() would handle storing these parsed values
  3. Both would lack proper validation for RFC-compliant host characters (semicolons are not allowed in hostnames) The high confidence comes from:
  • Direct reference to HttpURI.host field being incorrectly populated
  • URI parsing being a core responsibility of HttpURI class
  • Historical context that authority parsing is typically handled in these methods in Jetty's architecture

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### **s*ription URI us* wit*in J*tty's `*ttpURI` *l*ss **n p*rs* inv*li* URIs su** *s `*ttp://lo**l*ost;/p*t*` *s **vin* *n *ut*ority wit* * *ost o* `lo**l*ost;`. * URIs o* t** typ* `*ttp://lo**l*ost;/p*t*` s*oul* ** int*rpr*t** to ** *it**r inv*li*

Reasoning

T** vuln*r**ility st*ms *rom improp*r input v*li**tion in *ttpURI's *ut*ority p*rsin*. T** **visory sp**i*i**lly **lls out in*orr**t *ost p*rsin* *or URIs lik* '*ttp://lo**l*ost;/p*t*'. T** *or* issu* must *xist in t** *ut*ority p*rsin* work*low: *.