Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting

Vulnerability

Overview

CVE-2023-46749 is a path traversal vulnerability in Apache Shiro affecting versions before 1.13.0 or 2.0.0-alpha-4. The issue arises when path rewriting is enabled, allowing specially crafted requests to traverse directory paths and bypass authentication checks [1].

Exploitation

Details

An attacker can exploit this by sending an HTTP request with path traversal sequences (e.g., ../) in the URL when combined with path rewriting configurations. No authentication is required to trigger the vulnerability, as it occurs before access control checks are applied. The attack takes advantage of incomplete sanitization or handling of semicolons in the path; enabling the blockSemicolon configuration (which is the default) prevents exploitation [1].

Impact

Successful exploitation allows an attacker to bypass authentication and access protected resources or endpoints that should require valid credentials. This can lead to unauthorized data access, privilege escalation, or further compromise of the application [1].

Mitigation

Users should upgrade to Apache Shiro 1.13.0, 2.0.0-alpha-4, or later. Alternatively, ensuring the blockSemicolon setting is enabled (which is the default setting) will block the path traversal attack [1].