CVE-2022-23945 Apache ShenYu missing authentication allows gateway registration
Attackers can register malicious gateways without authentication, potentially compromising the Apache ShenYu admin interface and routing traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-23945?
CVE-2022-23945 is a high-severity missing authorization vulnerability in Apache ShenYu (incubating), published on 25 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Which versions are affected by CVE-2022-23945?
2 open source packages ship an affected version, including org.apache.shenyu:shenyu-common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.shenyu:shenyu-common Maven | From 2.4.0 | 2.4.2 |
org.apache.shenyu:shenyu-common Maven | From 2.4.0 | 2.4.2 |
Products include Apache Shenyu.
How do I fix CVE-2022-23945?
Upgrade org.apache.shenyu:shenyu-common to 2.4.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-23945 being exploited?
There is no known exploitation of CVE-2022-23945 in the wild and no public exploit code.
Other vulnerabilities in Apache ShenYu (incubating)
- CVE-2021-45029 Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection
- CVE-2021-37580 Apache ShenYu Admin bypass JWT authentication
- CVE-2022-23944 Apache ShenYu 2.4.1 Improper access control
- CVE-2022-42735 Apache ShenYu Admin ultra vires
- CVE-2022-37435 Apache ShenYu Admin Improper Privilege Management
Sources
Also known as GHSA-7rjp-fgwj-47rw.