Apache Shenyu Server Side Request Forgery vulnerability in org.apache.shenyu:shenyu-admin
Summary
CVE-2023-25753: Apache Shenyu Server Side Request Forgery vulnerability. Affects org.apache.shenyu:shenyu-admin versions < 2.6.0. Fixed in 2.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Shenyu is an open-source, extensible, and high-performance API gateway. It provides functionalities such as dynamic routing, traffic control, and load balancing. The shenyu-admin package is a component of Apache Shenyu that offers administrative features for managing the API gateway. However, a vulnerability has been discovered in the shenyu-admin package that allows for Server-Side Request Forgery (SSRF) attacks.
Vulnerability Detail
The SSRF vulnerability in Apache Shenyu's shenyu-admin package is located at the /sandbox/proxyGateway endpoint. By manipulating the requestUrl parameter, an attacker can send arbitrary requests and retrieve corresponding responses. This vulnerability grants the attacker control over the HTTP method, cookies, IP address, and headers, enabling them to dispatch complete HTTP requests to chosen hosts. The impact of this vulnerability can be severe, as it allows attackers to bypass security measures and potentially access sensitive information or perform unauthorized actions.
How To Fix
Latest published version: 2.7.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to a fixed version or apply the provided patch to ensure the security of the Apache Shenyu installation.
Conclusion
The Apache Shenyu shenyu-admin package is vulnerable to a Server-Side Request Forgery (SSRF) attack. This vulnerability allows attackers to manipulate requests and potentially access sensitive information or perform unauthorized actions. It is crucial to upgrade to Apache ShenYu version 2.6.0 or later or apply the provided patch to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.shenyu:shenyu-admin →
FAQ
Apache Shenyu is an open-source API gateway that provides dynamic routing, traffic control, and load balancing capabilities.
The shenyu-admin package is a component of Apache Shenyu that offers administrative features for managing the API gateway.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to manipulate server requests and potentially access internal resources or perform unauthorized actions.
With this vulnerability, an attacker can send arbitrary requests to chosen hosts, control HTTP methods, cookies, IP addresses, and headers. This can lead to unauthorized access to sensitive information or actions.
To fix this vulnerability, it is recommended to upgrade to Apache ShenYu version 2.6.0 or later. Alternatively, you can apply the provided patch available at https://github.com/apache/shenyu/pull/4776.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.shenyu:shenyu-admin.
