[I] Security: Shiro 1.10.0 CVEs (CVE-2023-22602 auth bypass) + Unauthenticated /actuator/** + /h2-console/** + /proxy/** [streampark]

["leanworld7-netizen (via GitHub)" <gi...@apache.org>]

leanworld7-netizen opened a new issue, #4472:
URL: https://github.com/apache/streampark/issues/4472

   ## Security Report: Shiro 1.10.0 CVEs + Unauthenticated Endpoints
   
   ### Summary
   Apache StreamPark uses Apache Shiro 1.10.0 which is affected by CVE-2023-22602 (authentication bypass when used with Spring Boot 2.6+). Additionally, several paths are mapped as `anon` in ShiroConfig.java which may expose sensitive endpoints.
   
   ### Finding 1: Shiro 1.10.0 — CVE-2023-22602
   - **pom.xml**: `<shiro.version>1.10.0</shiro.version>`
   - CVE-2023-22602: Authentication bypass via path traversal when Shiro < 1.11.0 is used with Spring Boot 2.6+
   - Exploit: `GET /xxx/..;/actuator/env` bypasses Shiro auth and reaches actuator endpoints
   - Fix: Upgrade Shiro to 1.13.0+
   
   ### Finding 2: Unauthenticated `/actuator/**`
   - **ShiroConfig.java L45**: `filterChainDefinitionMap.put("/actuator/**", "anon");`
   - Spring Boot Actuator endpoints are excluded from authentication
   - If actuator is on classpath, `/actuator/env` exposes environment variables and secrets
   
   ### Finding 3: Unauthenticated `/h2-console/**`
   - **ShiroConfig.java L46**: `filterChainDefinitionMap.put("/h2-console/**", "anon");`
   - H2 database console accessible without auth
   
   ### Finding 4: Unauthenticated `/proxy/**`
   - **ShiroConfig.java L77**: `filterChainDefinitionMap.put("/proxy/**", "anon");`
   - Proxy endpoint excluded from auth — potential SSRF
   
   ### Finding 5: FlinkShimsProxy Deserialization
   - **FlinkShimsProxy.java L120-122**: `ClassLoaderObjectInputStream.readObject()` with no ObjectInputFilter
   - Potential deserialization RCE if input is user-controlled
   
   ### Remediation
   1. Upgrade Shiro to 1.13.0+ (fixes CVE-2023-22602 and CVE-2023-46750)
   2. Remove `/actuator/**` and `/h2-console/**` anon mappings for production
   3. Investigate `/proxy/**` endpoint for SSRF
   4. Add ObjectInputFilter to ClassLoaderObjectInputStream
   
   This is a responsible disclosure per Apache security policy. If there is a private security reporting channel, please advise.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@streampark.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Security: Shiro 1.10.0 CVEs (CVE-2023-22602 auth bypass) + Unauthenticated /actuator/** + /h2-console/** + /proxy/** [streampark]

["wolfboys (via GitHub)" <gi...@apache.org>]

wolfboys closed issue #4472: Security: Shiro 1.10.0 CVEs (CVE-2023-22602 auth bypass) + Unauthenticated /actuator/** + /h2-console/** + /proxy/**
URL: https://github.com/apache/streampark/issues/4472


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@streampark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Security: Shiro 1.10.0 CVEs (CVE-2023-22602 auth bypass) + Unauthenticated /actuator/** + /h2-console/** + /proxy/** [streampark]

["wolfboys (via GitHub)" <gi...@apache.org>]

wolfboys commented on issue #4472:
URL: https://github.com/apache/streampark/issues/4472#issuecomment-5165900325

   Please follow Apache’s security reporting guidelines when submitting your report. For reference, please see:
   
   https://streampark.apache.org/community/security/


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@streampark.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org