PT-2023-8779 · Spring+2 · Spring Boot+2

CVE-2023-22602 · Publicado 2023-01-13 · Atualizado 2023-08-31

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Shiro versions prior to 1.11.0 Spring Boot versions 2.6+

Description The issue is related to a conflict of interpretations between Apache Shiro and Spring Boot, which can be exploited by a remote attacker using a specially crafted HTTP request to bypass authentication. This occurs when Shiro and Spring Boot use different pattern-matching techniques, with both defaulting to Ant style pattern matching in versions prior to Spring Boot 2.6.

Recommendations Update to Apache Shiro 1.11.0 Set the Spring Boot configuration value: spring.mvc.pathmatch.matching-strategy = ant path matcher

Exploit

Correção

Enumeração de Fraquezas

CWE-436

Identificadores relacionados

BDU:2024-01896

CVE-2023-22602

GHSA-7CXR-H8WM-FG4C

Produtos afetados

Apache Shiro

Debian

Spring Boot

Referências · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22602.json · Exploit
• https://github.com/apache/shiro · Nota
• https://t.me/cibsecurity/56506 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22602 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2023050803 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=2182198 · Nota
• https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-22602 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20230302-0001 · Nota
• https://t.me/canyoupwnme/6848 · Publicação no Telegram
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22602 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7cxr-h8wm-fg4c · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2023:3954 · Nota
• https://cve.org/CVERecord?id=CVE-2023-22602 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-01896 · Nota de Segurança