CVE-2023-22602 Apache Shiro Interpretation Conflict vulnerability

What is CVE-2023-22602?

CVE-2023-22602 is a high-severity vulnerability in Apache Shiro, published on 14 Jan 2023.

Official description

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass.

The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`

Weakness: CWE-436

Which versions are affected by CVE-2023-22602?

2 open source packages ship an affected version, including org.apache.shiro:shiro-root. It affects 2 products.

Products include Apache Shiro, Vmware Spring Boot.

How do I fix CVE-2023-22602?

Upgrade org.apache.shiro:shiro-root to 1.11.0 or later.

Is CVE-2023-22602 being exploited?

There is no known exploitation of CVE-2023-22602 in the wild and no public exploit code.

Other vulnerabilities in Apache Shiro

• CVE-2023-34478 Path Traversal in Apache Shiro Critical 9.8
• CVE-2022-40664 Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher Critical 9.8
• CVE-2022-32532 Authentication Bypass Vulnerability Critical 9.8
• CVE-2021-41303 Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypass Critical 9.8
• CVE-2020-17523 Authentication bypass in Apache Shiro Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2023-22602, GHSA-7cxr-h8wm-fg4c.