CVE-2020-13933

CVE-2020-13933 ラボ shiro 1.6.0 認証バイパス脆弱性 PoC http://127.0.0.1:8080/res/%3bpoc ラボ環境 コード説明 ShiroConfig.java： 権限設定。/res/ リソースへのリクエスト時に、302でログインページにリダイレクトし認証を行う。 NameController.java： ・ /res/name： name という名前のリソースをリクエスト（認証をトリガー） ・ /res/： リソースをリクエストしない（認証をトリガーしない） ラボ検証...

Authentication Bypass by Alternate Name

Overview org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name in the shiro-guice module when...

Replay Attack

Overview org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Replay Attack due to the server not verifying the expiration of the...

Session Fixation

Overview org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Session Fixation during the login operation in DefaultSecurityManager.ja...

Sensitive Cookie in HTTPS Session Without "Secure" Attribute

Overview org.apache.shiro:shiro-web is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Affected versions of this package are vulnerable to Sensitive Cookie in HTTPS Session Without "Secure" Attribute in the form...

Exploit for CVE-2020-13933

CVE-2020-13933 靶场 shiro 权限配置， 当请求 /res/ 资源时， 302 跳转到登陆页面进行身份认证 - NameController.java： · /res/name： 请求名为 name 的的资源（触发身份认证） · /res/： 不请求任何资源（不触发身份认证） 靶场验证 不在请求路由中指定资源名称时，不触发身份验证，也无资源返回： http://127.0.0.1:8080/res/ 在请求路由中指定资源名称时，302 跳转到身份验证页面： http://127.0.0.1:8080/res/poc 构造特定 PoC...

Authentication Bypass

shiro-web is vulnerable to authentication bypass. An ArrayIndexOutOfBoundsException in Base64decode causes an invalid session cookie to be parsed as valid...

Authentication Bypass

Apache Shiro-web is vulnerable to authentication bypass. Lack of proper handling of servletPath parameter in the request allows an attacker to inject malicious string via the request parameter and bypass authentication...

Information Disclosure

shiro-web is vulnerable to information disclosure. The vulnerability exists as a user can use requestURI + "/" to bypass the chain filter protection and access resources that are otherwise restricted...