CVE-2023-46750

Overview

Apache Shiro is an open-source Java security framework that performs authentication, authorization, cryptography, and session management for applications ranging from small mobile apps to large web and enterprise systems. Its shiro-web module installs Shiro as a servlet filter chain that enforces path-based authentication and authorization rules in front of the application.

An open redirect vulnerability (CVE-2023-46750) has been identified in Apache Shiro's form authentication flow, which allows attackers to redirect users to an attacker-controlled external site immediately after they complete a legitimate login.

Per OWASP: Unvalidated redirects and forwards are possible when a web application accepts untrusted input that could cause the web application to redirect the request to a URL contained within untrusted input. By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.

This issue affects all versions of Apache Shiro prior to 1.13.0, as well as the 2.0.0 alpha releases prior to 2.0.0-alpha-4.

Details

Module Info

• Product: Apache Shiro
• Affected packages: org.apache.shiro:shiro-web
• Affected versions: <1.13.0, >=2.0.0-alpha-1 <2.0.0-alpha-4
• GitHub repository: https://github.com/apache/shiro
• Published packages: https://central.sonatype.com/artifact/org.apache.shiro/shiro-web
• Package manager: Maven
• Fixed in: NES for Apache Shiro 1.8.0-shiro-1.8.2

Vulnerability Info

This Medium-severity vulnerability is found in the org.apache.shiro:shiro-web package in all versions of Apache Shiro prior to 1.13.0, as well as the 2.0.0 alpha releases prior to 2.0.0-alpha-4.

When an application protects a path with Shiro's form authentication (the authc filter, backed by FormAuthenticationFilter), a request from an unauthenticated user is saved before the user is sent to the login page: WebUtils.saveRequest constructs a SavedRequest that captures the raw request.getRequestURI() and query string. After a successful login, FormAuthenticationFilter calls WebUtils.redirectToSavedRequest, which takes the redirect target from SavedRequest.getRequestUrl() and issues it with contextRelative set to false, so the saved value is handed to response.sendRedirect without the context path being prepended and without any validation.

The redirect target is built by the following method in web/src/main/java/org/apache/shiro/web/util/SavedRequest.java:

public String getRequestUrl() {
    StringBuilder requestUrl = new StringBuilder(getRequestURI());
    if (getQueryString() != null) {
        requestUrl.append("?").append(getQueryString());
    }
    return requestUrl.toString();
}

Because the saved request URI is returned verbatim, a URI that begins with two slashes survives intact. Browsers interpret a Location value of the form //evil.example.com as a protocol-relative reference to a different host rather than as a local path. An attacker therefore lures a victim to a protected URL on the trusted application whose request URI begins with //evil.example.com; Shiro saves that URI, the victim completes a legitimate login on the real site, and Shiro then redirects the freshly authenticated victim to the attacker's site. The attack requires no privileges, only that the application relies on Shiro's default post-login return-to-requested-page behavior and that the victim follows the crafted link and logs in.

Mitigation

Apache Shiro 1.x is End-of-Life and no longer receives open-source updates to address this issue. The final 1.x release was 1.13.0; as of February 28, 2024, Shiro v1 was superseded by v2.

Users of the affected components should apply one of the following mitigations:

• Upgrade Apache Shiro to a currently supported release line that contains the fix, first shipped upstream in Apache Shiro 1.13.0.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Claudio Villella (finder)