Description:

CVE-2024-22201 is a vulnerability in Jetty, a Java-based web server and servlet engine. It allows an attacker to cause a denial-of-service (DoS) condition by establishing an HTTP/2 SSL connection and causing it to time out. This can lead to the server running out of file descriptors and eventually stopping accepting new connections from valid clients. The vulnerability has a CVSS score of 7.5 and an SVRS of 42, indicating a moderate level of severity.

Key Insights:

1. The vulnerability can be exploited remotely, allowing an attacker to launch a DoS attack without having to gain access to the server.
2. The vulnerability affects all versions of Jetty prior to 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
3. The vulnerability is actively exploited in the wild, with reports of attacks targeting servers running Jetty.
4. The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about the vulnerability, calling for immediate and necessary measures to mitigate the risk.

Mitigation Strategies:

1. Update Jetty to version 9.4.54, 10.0.20, 11.0.20, or 12.0.6 or later.
2. Implement rate limiting on incoming HTTP/2 connections to prevent an attacker from establishing a large number of connections.
3. Use a web application firewall (WAF) to block malicious requests that attempt to exploit the vulnerability.
4. Monitor network traffic for signs of a DoS attack and take appropriate action to mitigate the attack.

Additional Information:

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.