PT-2023-8779 · Spring+2 · Spring Boot+2

Published 2023-01-13 · Updated 2023-08-31 · CVE-2023-22602

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Shiro versions prior to 1.11.0 Spring Boot versions 2.6+

Description The issue is related to a conflict of interpretations between Apache Shiro and Spring Boot, which can be exploited by a remote attacker using a specially crafted HTTP request to bypass authentication. This occurs when Shiro and Spring Boot use different pattern-matching techniques, with both defaulting to Ant style pattern matching in versions prior to Spring Boot 2.6.

Recommendations Update to Apache Shiro 1.11.0 Set the Spring Boot configuration value: spring.mvc.pathmatch.matching-strategy = ant path matcher

Fix

Weakness Enumeration

CWE-436

Related Identifiers

BDU:2024-01896

CVE-2023-22602

GHSA-7CXR-H8WM-FG4C

Affected Products

Apache Shiro

Debian

Spring Boot

References · 22

• https://cve.org/CVERecord?id=CVE-2023-22602 · Security Note
• https://ubuntu.com/security/CVE-2023-22602 · Vendor Advisory
• https://lists.apache.org/thread/dzj0k2smpzzgj6g666hrbrgsrlf9yhkl · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22602 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-22602 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01896 · Security Note
• https://safe-surf.ru/upload/VULN-new/VULN.2023-05-10.1.pdf · Security Note
• https://osv.dev/vulnerability/CVE-2023-22602 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-22602 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-22602 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7cxr-h8wm-fg4c · Vendor Advisory
• https://github.com/apache/shiro · Note
• https://security.netapp.com/advisory/ntap-20230302-0001 · Note
• https://t.me/cibsecurity/56506 · Telegram Post
• https://t.me/pentestingnews/32194 · Telegram Post