漏洞分析
https://github.com/apache/shiro/commit/9762f97926ba99ac0d958e088cae3be8b657948d
主要是Spring web在匹配url的时候没有匹配上/导致绕过
环境搭建
下载代码
https://github.com/lenve/javaboy-code-samples/tree/master/shiro/shiro-basic
导入idea
修改Shiro版本1.4.2
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-web</artifactId>
<version>1.4.2</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.4.2</version>
</dependency>
修改ShiroConfig配置文件,添加authc拦截器的拦截正则
ShiroFilterFactoryBean shiroFilterFactoryBean() {
ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
...
...
//map.put("/*", "authc");
map.put("/hello/*", "authc");
bean.setFilterChainDefinitionMap(map);
return bean;
}
修改路由控制器方法
@GetMapping("/hello/{currentPage}")
public String hello(@PathVariable Integer currentPage) {
return "hello";
}
编译并启动
Your-ip:8080/login
漏洞复现
访问/hello/1接口,跳转到了登录页面
加上斜杠,过了
- 左青龙
- 微信扫一扫
- 右白虎
- 微信扫一扫
评论