CVE-2021-37580 Apache ShenYu Admin bypass JWT authentication
An attacker can bypass authentication in Apache ShenYu Admin due to incorrect JWT usage, gaining unauthorized access to the system.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-37580?
CVE-2021-37580 is a critical authentication bypass vulnerability in Apache ShenYu Admin, published on 16 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0
Weakness: CWE-287
Which versions are affected by CVE-2021-37580?
2 open source packages ship an affected version, including org.apache.shenyu:shenyu-admin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.shenyu:shenyu-admin Maven | From 2.3.0 | 2.4.1 |
org.apache.shenyu:shenyu-admin Maven | From 2.3.0 | 2.4.1 |
Products include Apache Shenyu.
How do I fix CVE-2021-37580?
Upgrade org.apache.shenyu:shenyu-admin to 2.4.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-37580 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-37580 exists.
Public exploit code: 1 Nuclei template and 7 proofs of concept on GitHub.
Other vulnerabilities in Apache ShenYu Admin
- CVE-2021-45029 Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection
- CVE-2022-23944 Apache ShenYu 2.4.1 Improper access control
- CVE-2022-42735 Apache ShenYu Admin ultra vires
- CVE-2022-37435 Apache ShenYu Admin Improper Privilege Management
- CVE-2022-26650 Apache ShenYu (incubating) Regular expression denial of service
Sources
Also known as GHSA-vpfp-5gwq-g533.