CVE-2023-46749: Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting
Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting
Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure blockSemicolon is enabled (this is the default).
Other sources
Apache Shiro before 1.130 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting
Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure blockSemicolon is enabled (this is the default).
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.shiro:shiro-coreto a version that resolves this vulnerability.Fixed in 2.0.0-alpha4 - Upgrade
Upgrade
maven/org.apache.shiro:shiro-coreto a version that resolves this vulnerability.Fixed in 1.13.0 - Upgrade
Upgrade
debian/shiroto a version that resolves this vulnerability.Fixed in 1.3.2-4+deb11u1Fixed in 1.3.2-5 - Upgrade
Upgrade
redhat/shiroto a version that resolves this vulnerability.Fixed in 1.13.0 - Upgrade
Upgrade
redhat/shiro 2.0.0-alphato a version that resolves this vulnerability.Fixed in 4 - Upgrade
Upgrade
Apache Shiroto a version that resolves this vulnerability.Fixed in 1.13.0 - Upgrade
Upgrade
Apache Shiroto a version that resolves this vulnerability.Fixed in 2.0.0-alpha-4 - Configuration
Ensure `blockSemicolon` is enabled to mitigate CVE-2023-46749 path traversal/authentication bypass when using path rewriting.
Apache Shiro blockSemicolon = enabled (default)
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46749?
CVE-2023-46749 has a high severity due to the potential for authentication bypass through a path traversal attack.
How do I fix CVE-2023-46749?
To fix CVE-2023-46749, update to Apache Shiro version 1.13.0 or higher, or 2.0.0-alpha-4 or higher.
Which versions of Apache Shiro are affected by CVE-2023-46749?
Apache Shiro versions before 1.13.0 and 2.0.0-alpha-4 are affected by CVE-2023-46749.
What is a path traversal attack in the context of CVE-2023-46749?
In the context of CVE-2023-46749, a path traversal attack allows an attacker to bypass authentication by manipulating URL paths.
Is enabling blockSemicolon an effective mitigation for CVE-2023-46749?
Yes, enabling blockSemicolon can be an effective mitigation for CVE-2023-46749 if upgrading is not immediately possible.