CVE-2023-34478

Overview

Apache Shiro is an open-source Java security framework that performs authentication, authorization, cryptography, and session management for applications ranging from small mobile apps to large web and enterprise systems. Its shiro-web module installs Shiro as a servlet filter chain that enforces path-based authentication and authorization rules in front of the application.

A path traversal vulnerability (CVE-2023-34478) has been identified in the shiro-web filtering layer, which allows attackers to reach protected resources without authenticating by sending a crafted, non-normalized URL. When Shiro is used together with APIs or other web frameworks that route requests based on non-normalized requests, the crafted URL is matched against the wrong Shiro filter chain, resulting in an authentication or authorization bypass.

Per OWASP: A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with "dot-dot-slash (../)" sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files.

This issue affects all versions of Apache Shiro before 1.12.0, as well as the 2.0.0-alpha-1 and 2.0.0-alpha-2 pre-releases.

Details

Module Info

• Product: Apache Shiro
• Affected packages: org.apache.shiro:shiro-web
• Affected versions: <1.12.0, >=2.0.0-alpha-1 <2.0.0-alpha-3
• GitHub repository: https://github.com/apache/shiro
• Published packages: https://central.sonatype.com/artifact/org.apache.shiro/shiro-web
• Package manager: Maven
• Fixed in: NES for Apache Shiro 1.8.0-shiro-1.8.2

Vulnerability Info

This Critical-severity vulnerability is found in the org.apache.shiro:shiro-web package in all versions of Apache Shiro before 1.12.0. Shiro's InvalidRequestFilter is the framework's global request-hardening filter: it is registered as the invalidRequest default filter and is prepended to every filter chain of a stock INI-configured Shiro web application, so it screens every incoming request by default. In affected versions its validity check rejects only semicolons, backslashes, and non-ASCII characters:

private boolean isValid(String uri) {
    return !StringUtils.hasText(uri)
           || ( !containsSemicolon(uri)
             && !containsBackslash(uri)
             && !containsNonAsciiCharacters(uri));
}

Path-traversal sequences such as .., /./, and the URL-encoded forms %2e and %2f pass through untouched. Shiro then selects the filter chain to enforce by normalizing the request path and matching it against the configured patterns with PathMatchingFilterChainResolver. When the application behind Shiro, such as an API framework or another router, resolves the same non-normalized URL differently, an attacker can craft a request, for example one containing /%2e%2e/ segments, that Shiro matches against an unprotected chain while the downstream framework dispatches it to a protected resource. The security checks configured for that resource are never applied, yielding a complete authentication and authorization bypass with no privileges or user interaction required.

Releases before 1.6.0 predate InvalidRequestFilter and shipped no global request-hardening filter at all, which the advisory's unbounded affected range reflects.

Mitigation

Apache Shiro 1.x is End-of-Life and no longer receives open-source updates to address this issue. The final 1.x release was 1.13.0; as of February 28, 2024, Shiro v1 was superseded by v2.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache Shiro to a currently supported release line that contains the fix, first shipped upstream in Apache Shiro 1.12.0.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• tkswifty (finder)
• Ha1c9on (finder)