Apache Shiro: Jakarta EE open redirect via untrusted Referer in post-login redirect flow

Vulnerability

In Apache Shiro versions 2.0-alpha to 2.2.0 and 3.0.0-alpha-1, the Jakarta EE integration module (shiro-jakarta-ee) uses the HTTP Referer header to determine the redirect target after a user login. The module does not properly validate this client-controlled value, allowing an attacker to supply an arbitrary redirect URL [1].

Exploitation

An attacker can craft a login request with a malicious Referer header pointing to an external site. When a user successfully authenticates, the application will redirect the browser to the attacker-specified URL. No authentication or special network position is required beyond influencing the victim's browser to send the crafted request [1].

Impact

Successful exploitation results in an open redirect, which can be used for phishing attacks, credential harvesting, or to bypass application-level access controls by redirecting users to a trusted-appearing external domain [1].

Mitigation

Upgrade to Apache Shiro version 2.2.1 or 3.0.0-alpha-2 or later. The fix validates the Referer header and restricts redirects to relative paths within the current application context. No workaround is available for affected versions [1].