Apache Shiro Jakarta EE module: Open redirect and SSRF (requires valid credentials)

Vulnerability

Apache Shiro versions 2.0-alpha through 2.1.0 and 3.0.0-alpha-1, when using the shiro-jakarta-ee integration module, have an open redirect and Server-Side Request Forgery (SSRF) vulnerability [1]. After a successful login, the Jakarta EE module uses an unencrypted and unvalidated shiroSavedRequest cookie to determine the redirect target [1].

Exploitation

An attacker needs valid login credentials to authenticate to the application [1]. After authentication, they can forge the shiroSavedRequest cookie value to point to an arbitrary URL [1]. The server then processes this cookie and sends an HTTP GET request from the server to the attacker-chosen URL [1].

Impact

Successful exploitation yields two outcomes: an open redirect that can be used for phishing, and a Server-Side Request Forgery (SSRF) that allows the attacker to make the server send HTTP GET requests to internal or external systems [1]. The attacker can leverage the SSRF to probe internal network services, access cloud metadata endpoints, or gather information that should not be accessible externally [1].

Mitigation

Upgrade to Apache Shiro version 2.1.1 or 3.0.0-alpha-2 or later, which encrypts the shiroSavedRequest cookie to prevent tampering [1]. No workaround is available for unpatched versions [1].