CVE-2023-22602

Overview

Apache Shiro is an open-source Java security framework that performs authentication, authorization, cryptography, and session management for applications ranging from small mobile apps to large web and enterprise systems. Its shiro-web module installs Shiro as a servlet filter chain that enforces path-based authentication and authorization rules in front of the application.

An authorization bypass vulnerability (CVE-2023-22602) has been identified in Apache Shiro's Spring Boot integration, which allows attackers to bypass the authentication and authorization rules enforced by Shiro's filter chain by sending a specially crafted HTTP request to an application running on Spring Boot 2.6.0 or later. Shiro resolves its filter chains with Ant-style pattern matching, while Spring Boot 2.6.0 changed Spring MVC's default request routing to the PathPatternParser strategy; the two engines can classify the same request URI differently, so a request that Shiro treats as unprotected can still be routed by Spring MVC to a protected endpoint.

Per CWE-436: Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

This issue affects all versions of Apache Shiro prior to 1.11.0 when used together with Spring Boot 2.6.0 or later.

Details

Module Info

• Product: Apache Shiro
• Affected packages: org.apache.shiro:shiro-spring-boot-starter, org.apache.shiro:shiro-spring-boot-web-starter
• Affected versions: <1.11.0
• GitHub repository: https://github.com/apache/shiro
• Published packages: https://central.sonatype.com/artifact/org.apache.shiro/shiro-spring-boot-starter, https://central.sonatype.com/artifact/org.apache.shiro/shiro-spring-boot-web-starter
• Package manager: Maven
• Fixed in: NES for Apache Shiro 1.8.0-shiro-1.8.2

Vulnerability Info

This High-severity vulnerability is found in the org.apache.shiro:shiro-spring-boot-starter package (and the org.apache.shiro:shiro-spring-boot-web-starter package that depends on it) in all versions of Apache Shiro prior to 1.11.0. Shiro decides which chain of security filters guards an incoming request by matching the request URI against the application's configured chain patterns (for example /admin/** = authc) using Shiro's own Ant-style AntPathMatcher:

public FilterChain getChain(ServletRequest request, ServletResponse response, FilterChain originalChain) {
    ...
    final String requestURI = getPathWithinApplication(request);
    final String requestURINoTrailingSlash = removeTrailingSlash(requestURI);
    ...
    for (String pathPattern : filterChainManager.getChainNames()) {
        // If the path does match, then pass on to the subclass implementation for specific checks:
        if (pathMatches(pathPattern, requestURI)) {

Spring Boot 2.6.0, released in November 2021, changed Spring MVC's default handler-mapping strategy from AntPathMatcher to PathPatternParser (the default of the spring.mvc.pathmatch.matching-strategy property flipped). From that point on, a Spring Boot application secured by the Shiro starters uses two different pattern engines on every request: Shiro matches the URI with Ant-style semantics to select a filter chain, and Spring MVC parses the same URI with PathPatternParser to route it to a controller. The two engines parse and normalize request URIs differently, so an attacker can craft a URI that fails to match the Shiro chain pattern guarding an endpoint, causing Shiro to treat the request as unprotected and let it pass, while Spring MVC still routes that same request to the protected controller. This interpretation conflict (CWE-436) results in an authentication bypass: no privileges or user interaction are required, and the attacker gains access to functionality that should have required authentication. The Shiro starter shipped no safeguard against this mismatch; nothing in the starter pinned Spring MVC's matching strategy back to Ant-style matching, leaving any Spring Boot 2.6.0+ application that protects Spring MVC endpoints with Shiro filter-chain definitions exposed.

Mitigation

Apache Shiro 1.x is End-of-Life and no longer receives open-source updates to address this issue. The final 1.x release was 1.13.0; as of February 28, 2024, Shiro v1 was superseded by v2.

Spring Boot applications that cannot upgrade immediately can apply the upstream advisory's mitigation by explicitly forcing Spring MVC back to Ant-style path matching, so both engines interpret request URIs the same way:

spring.mvc.pathmatch.matching-strategy=ant_path_matcher

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache Shiro to a currently supported release line that contains the fix, first shipped upstream in Apache Shiro 1.11.0.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• v3ged0ge (finder)
• Adamytd (finder)