CVE-2022-32532

Overview

Apache Shiro is an open-source Java security framework that performs authentication, authorization, cryptography, and session management for applications ranging from small mobile apps to large web and enterprise systems. Its shiro-web module installs Shiro as a servlet filter chain that enforces path-based authentication and authorization rules in front of the application.

An authorization bypass vulnerability (CVE-2022-32532) has been identified in Apache Shiro, which allows attackers to bypass the authentication and authorization rules enforced by a regex-based filter chain by including a newline character in the request path.

Per CWE-863: the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

This issue affects all versions of Apache Shiro prior to 1.9.1.

Details

Module Info

• Product: Apache Shiro
• Affected packages: org.apache.shiro:shiro-core
• Affected versions: <1.9.1
• GitHub repository: https://github.com/apache/shiro
• Published packages: https://central.sonatype.com/artifact/org.apache.shiro/shiro-core
• Package manager: Maven
• Fixed in: NES for Apache Shiro 1.8.0-shiro-1.8.2

Vulnerability Info

This Critical-severity vulnerability is found in the org.apache.shiro:shiro-core package in all versions of Apache Shiro prior to 1.9.1. Shiro guards URL paths with chains of authentication and authorization filters, and the matcher that decides which chain applies to a request path is pluggable. When an application configures the regex-based RegExPatternMatcher (for example on PathMatchingFilterChainResolver or a PathMatchingFilter), every path pattern is compiled with no regex flags:

public boolean matches(String pattern, String source) {
    if (pattern == null) {
        throw new IllegalArgumentException("pattern argument cannot be null.");
    }
    Pattern p = Pattern.compile(pattern);
    Matcher m = p.matcher(source);
    return m.matches();
}

Without the Pattern.DOTALL flag, the regex metacharacter . does not match newline characters such as \n or \r. A pattern like /admin/.*, written with the intent of covering everything under /admin/, therefore fails to match a request path that contains a trailing or embedded newline, for example /admin/page\n. On servlet containers that pass such characters through in the request URI, an attacker can append a newline to the path so that the request no longer matches the .-based pattern guarding a filter chain, and the security filters that should have applied are skipped. The result is an authentication and authorization bypass.

Shiro's default path matcher is the non-regex AntPathMatcher, so only applications that explicitly configure RegExPatternMatcher and guard paths with .-based regular expressions are exposed.

Mitigation

Apache Shiro 1.x is End-of-Life and no longer receives open-source updates to address this issue. The final 1.x release was 1.13.0; as of February 28, 2024, Shiro v1 was superseded by v2.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache Shiro to a currently supported release line that contains the fix, first shipped upstream in Apache Shiro 1.9.1.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• 4ra1n (finder)