Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass

Vulnerability

Apache Shiro versions prior to 1.8.0, when used with Spring Boot, are vulnerable to an authentication bypass. A specially crafted HTTP request can exploit this flaw, allowing an attacker to bypass security controls. The vulnerability exists in the default configuration when Shiro integrates with Spring Boot's auto-configuration. [1]

Exploitation

An attacker only needs network access to the target application. No prior authentication is required. The attacker crafts a malicious HTTP request that manipulates the authentication process, leading to bypass. The exact request structure is not publicly detailed but leverages Shiro's handling of specially crafted inputs. [1]

Impact

Successful exploitation results in authentication bypass. The attacker can gain unauthorized access to protected resources or perform actions as any user without valid credentials. This compromises the confidentiality, integrity, and availability of the application. [1]

Mitigation

Users should upgrade to Apache Shiro version 1.8.0 or later, which contains the fix. No workarounds are provided in the available references. The fix was released in September 2021. [1]