Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher

Vulnerability

Description

Apache Shiro prior to version 1.10.0 is vulnerable to an authentication bypass that occurs when the application uses RequestDispatcher.forward() or RequestDispatcher.include() [1][4]. The root cause is that Shiro's filtering mechanism does not properly handle requests that are forwarded or included, potentially allowing unauthenticated access to protected resources.

Exploitation

An attacker can exploit this vulnerability by crafting a request that triggers a forward or include operation, bypassing the authentication checks that would normally be applied [2]. No special privileges are required, as the attack is performed remotely over the network. The vulnerability is present in applications using Apache Shiro's servlet filter integration.

Impact

Successful exploitation allows an attacker to bypass authentication and access protected pages or endpoints without proper credentials. This could lead to unauthorized information disclosure, privilege escalation, or further system compromise.

Mitigation

The vulnerability is fixed in Apache Shiro version 1.10.0 [2][4]. Users are strongly advised to upgrade to this version or later. No workarounds are currently available for earlier versions.