CVE-2022-23944 Apache ShenYu 2.4.1 Improper access control
Attackers can access plugin APIs without authentication, potentially reading or modifying configuration data in Apache ShenYu.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23944?
CVE-2022-23944 is a critical missing authorization vulnerability in Apache ShenYu (incubating), published on 25 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Which versions are affected by CVE-2022-23944?
2 open source packages ship an affected version, including org.apache.shenyu:shenyu-common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.shenyu:shenyu-common Maven | From 2.4.0 | 2.4.2 |
org.apache.shenyu:shenyu-common Maven | From 2.4.0 | 2.4.2 |
Products include Apache Shenyu.
How do I fix CVE-2022-23944?
Upgrade org.apache.shenyu:shenyu-common to 2.4.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-23944 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-23944 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in Apache ShenYu (incubating)
- CVE-2021-45029 Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection
- CVE-2021-37580 Apache ShenYu Admin bypass JWT authentication
- CVE-2022-42735 Apache ShenYu Admin ultra vires
- CVE-2022-37435 Apache ShenYu Admin Improper Privilege Management
- CVE-2022-26650 Apache ShenYu (incubating) Regular expression denial of service
Sources
Also known as GHSA-6v39-p2xq-g5c3.