Authorization Bypass Vulnerability in Apache Shiro - CVE-2022-32532
Summary
CVE-2022-32532: Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Affects shiro versions < 2b532117ac341a47c27ea8c17262e79fe54aee32. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Shiro is a powerful and flexible open-source security framework that handles authentication, authorization, cryptography, and session management for Java applications. It is widely used for securing web applications and services. The vulnerability CVE-2022-32532 affects versions prior to 1.9.1, where a misconfiguration in the RegexRequestMatcher can lead to an authorization bypass, potentially exposing sensitive resources to unauthorized users.
Vulnerability Detail
The vulnerability arises from the improper configuration of the RegexRequestMatcher in Apache Shiro, particularly when using regular expressions that include a dot (.) character. This misconfiguration can allow attackers to bypass authorization checks in certain servlet containers, leading to unauthorized access to protected resources. The potential ramifications include exposure of sensitive data and functionalities, which could be exploited by malicious actors.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, consider reviewing and modifying your regular expressions used in RegexRequestMatcher to avoid using the dot (.) character, which can lead to misconfigurations. Ensure that your authorization checks are robust and do not rely solely on regex patterns that may be bypassed.
Conclusion
CVE-2022-32532 represents a significant security risk for applications using Apache Shiro versions prior to 1.9.1. It is crucial for developers and system administrators to upgrade to the latest version to mitigate the risk of unauthorized access. Additionally, reviewing regex configurations can help prevent potential exploitation.
See every vulnerability recorded for shiro →
FAQ
CVE-2022-32532 is a vulnerability in Apache Shiro that allows for potential authorization bypass due to misconfigured RegexRequestMatcher.
Versions of Apache Shiro prior to 1.9.1 are affected by this vulnerability.
The vulnerability can lead to unauthorized access to sensitive resources, potentially exposing critical data and functionalities.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2022-32532 is 9.8, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for shiro.
