PT-2021-21721 · Apache · Apache Shenyu

伍 雄Loading · Published 2021-11-16 · Updated 2024-02-28 · CVE-2021-37580

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache ShenYu versions 2.3.0 through 2.4.0

Description A flaw was found in Apache ShenYu Admin, where the incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication.

Recommendations For versions 2.3.0 and 2.4.0, update to a version that fixes the authentication bypass issue. As a temporary workaround, consider restricting access to the ShenyuAdminBootstrap component until a patch is available. Avoid using the JWT authentication mechanism in the affected Apache ShenYu versions until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-37580

GHSA-VPFP-5GWQ-G533

Affected Products

Apache Shenyu

References · 19

• 🔥 https://github.com/fengwenhua/CVE-2021-37580 · Exploit
• 🔥 https://github.com/Liang2580/CVE-2021-37580 · Exploit
• 🔥 https://github.com/rabbitsafe/CVE-2021-37580 · Exploit
• 🔥 https://github.com/ZororoZ/CVE-2021-37580 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-37580 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37580 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vpfp-5gwq-g533 · Vendor Advisory
• https://lists.apache.org/thread/o15j25qwtpcw62k48xw1tnv48skh3zgb · Vendor Advisory
• https://github.com/apache/shenyu/releases/tag/v2.4.1 · Note
• https://github.com/apache/shenyu/commit/f78adb26926ba53b4ec5c21f2cf7e931461d601d · Note
• https://github.com/apache/shenyu · Note
• https://t.me/defcon_news/90294 · Telegram Post
• http://openwall.com/lists/oss-security/2021/11/16/1 · Note
• https://t.me/rnetsec/16053 · Telegram Post
• https://t.me/ckure/10180 · Telegram Post