CVE-2023-25753 Server-Side Request Forgery in Apache ShenYu
Attackers can exploit an SSRF vulnerability in Apache ShenYu to send arbitrary HTTP requests to internal or external hosts, potentially accessing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-25753?
CVE-2023-25753 is a medium-severity server-side request forgery vulnerability in Apache ShenYu, published on 19 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter.
Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing.
This issue affects Apache ShenYu: 2.5.1.
Upgrade to Apache ShenYu 2.6.0 or apply patch https://github.com/apache/shenyu/pull/4776 .
Weakness: CWE-918
Which versions are affected by CVE-2023-25753?
4 open source packages ship an affected version, including org.apache.shenyu:shenyu-admin and org.apache.shenyu:shenyu-common. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.shenyu:shenyu-admin Maven | All versions | 2.6.0 |
org.apache.shenyu:shenyu-admin Maven | All versions | 2.6.0 |
org.apache.shenyu:shenyu-common Maven | All versions | 2.6.0 |
org.apache.shenyu:shenyu-common Maven | All versions | 2.6.0 |
Products include Apache Shenyu.
How do I fix CVE-2023-25753?
Upgrade org.apache.shenyu:shenyu-admin to 2.6.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-25753 being exploited?
There is no known exploitation of CVE-2023-25753 in the wild and no public exploit code.
Other vulnerabilities in Apache ShenYu
- CVE-2021-45029 Apache ShenYu 2.4.1 Groovy Code Injection & SpEL Injection
- CVE-2021-37580 Apache ShenYu Admin bypass JWT authentication
- CVE-2022-23944 Apache ShenYu 2.4.1 Improper access control
- CVE-2022-42735 Apache ShenYu Admin ultra vires
- CVE-2022-37435 Apache ShenYu Admin Improper Privilege Management
Sources
Also known as GHSA-7w8v-5fcq-pvqw.