Skip to content
KitploitKITPLOIT
工具博客
提交
工具博客
提交

黑客、渗透测试和网络安全工具,武装您的安全武器库!

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新,查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
shiro-cve-2022-32532 — 最小化的Java Web应用程序,用于复现CVE-2022-32532,即通过URL中的换行字符绕过Apache Shiro RegExPatternMatcher身份验证。 | Kitploit
工具/GitHubGitHub/my0113/shiro-cve-2022-32532
身份验证与授权漏洞分析漏洞利用Web应用程序漏洞利用渗透测试学习与教育
GitHubmy0113/shiro-cve-2022-32532

shiro-cve-2022-32532

最小化的Java Web应用程序,用于复现CVE-2022-32532,即通过URL中的换行字符绕过Apache Shiro RegExPatternMatcher身份验证。

查看仓库
21年前尚未审核

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
分享

Apache Shiro CVE-2022-32532 复现环境

这是一个用于复现 CVE-2022-32532(Apache Shiro RegExPatternMatcher 认证绕过)的最小化 Web 应用。

漏洞说明

  • CVE: CVE-2022-32532
  • 影响版本: Shiro < 1.9.1
  • 原因: RegExPatternMatcher 未正确锚定正则表达式,可能导致路径绕过。具体来说就是使用java默认的正则表达式匹配逻辑,当遇到.符号作为正则表达式时会忽略\r(%0d)\n(%0a)这种特殊符号。必须显示使用基于PATTERN.DOTALL模式的正则匹配规则才能正确处理\r、\n符号。而低于shiro-1.9.1的版本均使用默认的正则匹配逻辑,所以无法正确处理\r、\n导致绕过鉴权。

如何复现

  1. 启动应用

    root@kitploit:~
    启动ShiroCve202232532Application
    
    
  2. 通过shiro正常鉴权返回access denied的url如下
    http://localhost:8080/permit/xxx, 最后面的xxx可以换成任意字符

  3. 绕过shiro鉴权返回success的url如下
    http://localhost:8080/permit/xxx, 即在最后面的xxx中插入换行符\n(%0a)、回车符\r(%0d)

  4. 解决方法

    1)从https://github.com/apache/shiro/blob/shiro-root-1.9.1/core/src/main/java/org/apache/shiro/util/下复制RegExPatternMatcher.java和PatternMatcher.java的全部内容。
    2)使用jdk11编译这两个java文件为RegExPatternMatcher.class和PatternMatcher.class。
    3)使用WinRAR将这2个class文件放入shiro-core-1.6.0.jar的org/apache/shiro/util/下。
    4)修复测试是将shiro-core-1.9.1中的RegExPatternMatcher.java代码复制到本案例中改为了RegExPatternMatcher191.java,然后将MyFilter第15行和MyShiroFilterFactoryBean第29行的new RegExPatternMatcher()改为new RegExPatternMatcher191()就可以了。
    5)shiro-core-1.9.1中的RegExPatternMatcher实现逻辑如下:

root@kitploit:~
/*
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied.  See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */
package org.apache.shiro.util;

import java.util.regex.Pattern;
import java.util.regex.Matcher;

/**
 * {@code PatternMatcher} implementation that uses standard {@link java.util.regex} objects.
 *
 * @see Pattern
 * @since 1.0
 */
public class RegExPatternMatcher implements PatternMatcher {

   private static final int DEFAULT = Pattern.DOTALL;

   private static final int CASE_INSENSITIVE = DEFAULT | Pattern.CASE_INSENSITIVE;

   private boolean caseInsensitive = false;

   /**
    * Simple implementation that merely uses the default pattern comparison logic provided by the
    * JDK.
    * <p/>This implementation essentially executes the following:
    * <pre>
    * Pattern p = Pattern.compile(pattern, Pattern.DOTALL);
    * Matcher m = p.matcher(source);
    * return m.matches();</pre>
    * @param pattern the pattern to match against
    * @param source  the source to match
    * @return {@code true} if the source matches the required pattern, {@code false} otherwise.
    */
   public boolean matches(String pattern, String source) {
      if (pattern == null) {
         throw new IllegalArgumentException("pattern argument cannot be null.");
      }
      Pattern p = Pattern.compile(pattern, caseInsensitive ? CASE_INSENSITIVE : DEFAULT);
      Matcher m = p.matcher(source);
      return m.matches();
   }

   /**
    * Returns true if regex match should be case-insensitive.
    * @return true if regex match should be case-insensitive.
    */
   public boolean isCaseInsensitive() {
      return caseInsensitive;
   }

   /**
    * Adds the Pattern.CASE_INSENSITIVE flag when compiling patterns.
    * @param caseInsensitive true if patterns should match case-insensitive.
    */
   public void setCaseInsensitive(boolean caseInsensitive) {
      this.caseInsensitive = caseInsensitive;
   }
}
下载工具