CVE-2020-11989: Apache Shiro Auth Bypass Vulnerability

CVE-2020-11989 Overview

CVE-2020-11989 is an authentication bypass vulnerability in Apache Shiro versions prior to 1.5.3. When Apache Shiro is used in conjunction with Spring dynamic controllers, an attacker can craft a specially designed HTTP request to bypass authentication mechanisms entirely. This vulnerability allows unauthorized access to protected resources and endpoints that should require valid credentials.

Critical Impact

This authentication bypass vulnerability enables unauthenticated attackers to access protected resources in applications using Apache Shiro with Spring dynamic controllers, potentially leading to complete system compromise.

Affected Products

• Apache Shiro versions prior to 1.5.3
• Applications using Apache Shiro with Spring Framework dynamic controllers
• Apache Geode implementations using vulnerable Shiro versions

Discovery Timeline

• June 22, 2020 - CVE-2020-11989 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-11989

Vulnerability Analysis

This authentication bypass vulnerability exists in Apache Shiro's request path processing when integrated with Spring Framework's dynamic controllers. The flaw stems from inconsistencies in how Shiro normalizes and matches URL paths against security filter configurations compared to how Spring resolves controller mappings.

When processing incoming requests, Apache Shiro's path matching logic can be manipulated through specially crafted request URIs. The inconsistency between Shiro's path normalization and Spring's request routing creates a security gap where malicious requests can reach protected endpoints without triggering authentication checks.

The vulnerability is particularly dangerous because it requires no user interaction or prior authentication. Attackers can exploit this flaw remotely over the network to access administrative interfaces, sensitive data endpoints, or any other protected resources within the application.

Root Cause

The root cause of CVE-2020-11989 lies in the path normalization discrepancy between Apache Shiro's URL pattern matching and Spring Framework's request dispatching mechanism. Shiro performs path matching against its configured security filters using one normalization approach, while Spring's dynamic controllers may resolve the same request using different path resolution logic.

This mismatch allows crafted request paths to satisfy Shiro's filter rules (appearing to not require authentication) while still being routed by Spring to protected controller endpoints. The fundamental issue is the assumption that both frameworks would interpret and normalize request paths identically, which is not the case in certain configurations involving dynamic controllers.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication or user interaction. Attackers exploit the vulnerability by sending HTTP requests with specially crafted URI paths to applications running Apache Shiro with Spring dynamic controllers.

The attack methodology involves manipulating the request path in ways that cause Shiro's security filters to misclassify the request as not requiring authentication, while Spring still routes the request to protected controller methods. This can involve techniques such as path traversal sequences, URL encoding variations, or other path manipulation tactics that exploit the normalization differences between the two frameworks.

Detection Methods for CVE-2020-11989

Indicators of Compromise

• Unusual HTTP request patterns with abnormal path encodings or traversal sequences targeting protected endpoints
• Access log entries showing successful requests to authenticated resources without corresponding session establishment
• Web application logs indicating access to protected resources from unauthenticated sessions
• Anomalous path patterns in requests that differ from normal application usage

Detection Strategies

• Implement web application firewall rules to detect and block requests with suspicious path manipulation attempts
• Monitor Apache Shiro authentication logs for discrepancies between expected and actual authentication states
• Deploy intrusion detection signatures that identify common authentication bypass request patterns
• Review application access logs for requests to protected endpoints that bypassed authentication

Monitoring Recommendations

• Enable detailed logging for both Apache Shiro security filter processing and Spring request routing
• Configure alerts for access to sensitive endpoints without valid session cookies or authentication tokens
• Implement real-time monitoring of authentication bypass attempts using SIEM solutions
• Regularly audit access patterns to protected resources to identify anomalous unauthenticated access

How to Mitigate CVE-2020-11989

Immediate Actions Required

• Upgrade Apache Shiro to version 1.5.3 or later immediately
• Review application security configurations to ensure all protected endpoints are properly secured
• Audit access logs to determine if exploitation has occurred prior to patching
• Implement additional authentication checks at the application layer as a defense-in-depth measure

Patch Information

Apache has addressed this vulnerability in Apache Shiro version 1.5.3. Organizations should upgrade to this version or later to remediate the vulnerability. The fix addresses the path normalization inconsistency between Shiro and Spring Framework to ensure authentication filters are properly applied to all requests.

For detailed information, refer to the Apache Shiro User Advisory and the Apache Shiro Commits Thread.

Workarounds

• Implement additional authentication validation at the Spring controller level to verify user authentication status
• Configure web server or reverse proxy rules to normalize and sanitize request paths before they reach the application
• Use strict path matching patterns in Shiro configuration to reduce the attack surface
• Deploy a web application firewall with rules to block path manipulation attempts

# Example Maven dependency update to patch Apache Shiro
# Update pom.xml to use patched version
# Replace:
#   <shiro.version>1.5.2</shiro.version>
# With:
#   <shiro.version>1.5.3</shiro.version>

# Verify Shiro version after update
mvn dependency:tree | grep shiro