CVE-2022-40664

Overview

Apache Shiro is an open-source Java security framework that performs authentication, authorization, cryptography, and session management for applications ranging from small mobile apps to large web and enterprise systems. Its shiro-web module installs Shiro as a servlet filter chain that enforces path-based authentication and authorization rules in front of the application.

An authorization bypass vulnerability (CVE-2022-40664) has been identified in Apache Shiro's OncePerRequestFilter, which allows unauthenticated attackers to reach Shiro-protected paths when a request is forwarded or included through a RequestDispatcher, because Shiro's authentication and authorization filters are silently skipped on the second dispatch.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects all versions of Apache Shiro prior to 1.10.0.

Details

Module Info

• Product: Apache Shiro
• Affected packages: org.apache.shiro:shiro-web
• Affected versions: <1.10.0
• GitHub repository: https://github.com/apache/shiro
• Published packages: https://central.sonatype.com/artifact/org.apache.shiro/shiro-web
• Package manager: Maven
• Fixed in: NES for Apache Shiro 1.8.0-shiro-1.8.2

Vulnerability Info

This Critical-severity vulnerability is found in the shiro-web package in all versions of Apache Shiro prior to 1.10.0. Shiro's servlet security filters extend OncePerRequestFilter, whose doFilter method marks each request with an "already filtered" request attribute the first time it runs and then refuses to run again for the same request:

if ( request.getAttribute(alreadyFilteredAttributeName) != null ) {
    log.trace("Filter '{}' already executed.  Proceeding without invoking this filter.", getName());
    filterChain.doFilter(request, response);
}

When application or framework code performs a server-side RequestDispatcher.forward() or RequestDispatcher.include() to a different path, the Shiro filter chain is re-entered for the dispatched request. Because the attribute set on the first pass is still present, the guard above passes the request straight through the chain without evaluating any of Shiro's security filters against the new target path. An unauthenticated request that lands on a permitted entry path and is then forwarded or included into a protected path (for example one mapped to authc in the filter chain definition, such as /admin/**) reaches the protected resource without Shiro enforcing its authentication or authorization rules. No credentials and no user interaction are required.

Any servlet web application that installs Shiro's filter is exposed, whether configured through ShiroFilter in web.xml, Spring's ShiroFilterFactoryBean, or Guice's ShiroWebModule, when the container or framework routes forwarded or included dispatches back through the Shiro filter. The permissive short-circuit is present in every Shiro release before 1.10.0, including 1.8.0.

Mitigation

Apache Shiro 1.x is End-of-Life and no longer receives open-source updates to address this issue. The final 1.x release was 1.13.0; as of February 28, 2024, Shiro v1 was superseded by v2.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache Shiro to a currently supported release line that contains the fix, first shipped upstream in Apache Shiro 1.10.0.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Y4tacker (finder)