CVE-2022-32532

CVE-2022-32532 概要 これはデモプロジェクトであり、この脆弱性（CVE-2022-32532）を悪用するための条件の1つを示すものにすぎません。 実際には、もっと多くの悪用方法があります。開発者が RegExPatternMatcher を使用する限り、バイパスの脆弱性が発生する可能性があります。 紹介 現在の構成では、トークンリクエストヘッダーの検証が必要です。そうでない場合、/permit 配下のインターフェースにアクセスする権限がありません。 このリクエストは成功します root@kitploit: GET /permit/any HTTP/1.1 Token:...

shiro-cve-2022-32532

Apache Shiro CVE-2022-32532 Reproduction Environment This is a minimal web application for reproducing CVE-2022-32532 Apache Shiro RegExPatternMatcher authentication bypass. Vulnerability Description CVE : CVE-2022-32532 Affected versions : Shiro 1.9.1 Cause : RegExPatternMatcher does not properl...

Security Bulletin: Apache Shiro (Publicly disclosed vulnerability) Affects IBM Partner Engagement Manager (CVE-2022-32532)

Summary IBM Sterling Partner Engagement Manager uses Apache Shiro library 1.9.1, where A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

CVE-2022-32532

A flaw was sound in Apache Shiro's RegexRequestMatcher, which can be misconfigured and bypassed on some servlet containers. Applications using RegExPatternMatcher with '.' in the regular expression are vulnerable to an authorization bypass...

Authorization Bypass

shiro-core is vulnerable to authorization bypass. The vulnerability exists due to the case-insensitive regex pattern matching used in the matches function of RegExPatternMatcher.java, allowing an attacker to bypass the servlet container when RegExPatternMatcher with . in the regular expression...

Improper Authorization in Apache Shiro

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

CVE-2022-32532

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

Authorization

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

CVE-2022-32532 Authentication Bypass Vulnerability

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

CVE-2022-32532

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...

CVE-2022-32532 Authentication Bypass Vulnerability

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with . in the regular expression are possibly vulnerable to an authorization bypass...