Issue with URL Parsing in Jetty HttpURI Class Not Complying with RFC Standards

[zer0yu]

Jetty version(s)

• Jetty 12.0.10 and Jetty 12.0.12

Jetty Environment

• core

Java version/vendor (use: java -version)

java version "21.0.3" 2024-04-16 LTS
Java(TM) SE Runtime Environment (build 21.0.3+7-LTS-235)
Java HotSpot(TM) 64-Bit Server VM (build 21.0.3+7-LTS-235, mixed mode)

OS type/version

• Ubuntu 20.04.6 LTS

Description

I would like to report an issue related to inconsistent URL parsing in Jetty's org.eclipse.jetty.http.HttpURI class, which may lead to potential security risks.

When parsing certain malformed URLs containing invalid IPv6 literals and port numbers, Jetty's parsing behavior differs from standard parsers and its own newer versions. This inconsistency can cause unexpected results and may introduce vulnerabilities such as Server-Side Request Forgery (SSRF) and access control bypasses.

How to reproduce?

1. Test Payloads and Observed Behavior:

   Payload	Browser (Chrome)	Rust	Python urllib3	Jetty 12.0.10	Jetty 12.0.12
   http://[vulndetector.com]:99999	Invalid URL	Invalid IPv6 address	Failed to parse	Port: 99999	Error: Bad authority
   http://vulndetector.com:99999/	Invalid URL	Invalid port number	Failed to parse	Port: 99999	Port: 99999
   http://localhost:-1	Invalid URL	Invalid port number	Failed to parse	Error: Exception (e.g., !hex 45)	Host: localhost:-1 Port: -1
   http://[localhost:-1]	Invalid URL	Invalid IPv6 address	Failed to parse	Error: Index out of bounds exception	Error: Bad authority

2. Reproduction Steps:

   • Code Sample:

     import org.eclipse.jetty.http.HttpURI;
     
     public class TestHttpURI {
      public static void main(String[] args) {
          String[] testUrls = {
              "http://[vulndetector.com]:99999",
              "http://vulndetector.com:99999/",
              "http://localhost:-1",
              "http://[localhost:-1]"
          };
     
          for (String url : testUrls) {
              try {
                  HttpURI httpUri = new HttpURI(url);
                  System.out.println("URL: " + url);
                  System.out.println("Host: " + httpUri.getHost());
                  System.out.println("Port: " + httpUri.getPort());
                  System.out.println("-----------------------------");
              } catch (Exception e) {
                  System.out.println("URL: " + url);
                  System.out.println("Error: " + e.getMessage());
                  System.out.println("-----------------------------");
              }
          }
      }
     }

   • Execution:

     • Compile the code:

     javac -cp /path/to/jetty-http-12.0.10.jar TestHttpURI.java

     • Run the code with Jetty 12.0.10:

     java -cp .:/path/to/jetty-http-12.0.10.jar TestHttpURI

     • Run the code with Jetty 12.0.12:

     java -cp .:/path/to/jetty-http-12.0.12.jar TestHttpURI

3. Expected Behavior:

   • The parser should strictly adhere to RFC 3986 and reject invalid URLs.
   • Invalid IPv6 literals and invalid port numbers should result in clear exceptions or error messages.

4. Observed Behavior:

   • Jetty 12.0.10:

     • Accepts invalid URLs and extracts port numbers even when they are out of the valid range.
     • May produce unexpected results or exceptions.

   • Jetty 12.0.12:

     • Introduces stricter validation, rejecting malformed URLs with errors like "Bad authority".
     • However, inconsistencies still exist compared to other standard parsers.

Additional Information:

• RFC 3986 Compliance:

  • Square brackets in URIs are reserved exclusively for enclosing IPv6 address literals.
  • Hostnames or domain names should not be enclosed within square brackets unless they are valid IPv6 addresses.
  • Valid port numbers should be positive integers between 0 and 65535.

• Potential Impact:

  • Security Risks:
  • Applications may be vulnerable to SSRF attacks or access control bypasses due to incorrect parsing.
  • Operational Issues:
  • Unexpected behavior or exceptions may disrupt normal application functionality.

Recommendation:

• Review and update the URL parsing logic in org.eclipse.jetty.http.HttpURI to ensure strict compliance with RFC 3986.
• Implement consistent error handling and validation for malformed URLs.
• Align parsing behavior with standard libraries to prevent inconsistencies.