xaccefy opened a new pull request, #2836:
URL: https://github.com/apache/shiro/pull/2836
## Problem
When `WebUtils.getPathWithinApplication()` receives a path where
`normalize()` returns null (because the path attempts to traverse above root,
e.g. `getServletPath()="/"` and `getPathInfo()="../"` produce the concatenated
path `/../`), the method returns null.
`PathMatchingFilterChainResolver.getChain()` then:
1. Passes null to `AntPathMatcher.matches()` which returns false for all
patterns (null never matches anything)
2. Returns null because no chain matched
`AbstractShiroFilter.getExecutionChain()` treats null from the resolver as
"no chain configured" and uses the original container `FilterChain` — this
**bypasses all Shiro filters** (authc, roles, perms, `InvalidRequestFilter`,
etc.).
This vulnerability class (path normalization mismatch leading to filter
bypass) has been the root cause of multiple prior Shiro CVEs (CVE-2020-1957,
CVE-2020-11989, CVE-2023-34478). This particular edge case — `normalize()`
returning null — was introduced when `normalize()` was added to
`getPathWithinApplication()` in commit b90f91875 (Shiro 1.5.3, CVE-2020-11989
fix) and has remained unhandled since.
## Fix
Two layers of defense:
1. **`WebUtils.getPathWithinApplication()`**: Return `"/"` instead of `null`
when `normalize()` fails, so the path always matches the `/**` catch-all
pattern.
2. **`PathMatchingFilterChainResolver.getChain()`**: Safety net that falls
back to the `/**` chain when `requestURI` is null or empty (defense-in-depth
for subclasses that override path resolution).
## Tests
- `NullNormalizationBypassPocTest.java` — 4 tests covering:
- `getServletPath()="/"` + `getPathInfo()="../"` → null normalization →
fix resolves to `"/"`
- Resolver returns null safely without `/**` chain
- `/**` catch-all prevents the bypass when configured
- URL variants `/./../` and `//../` also normalize to null
- `WebUtilsTest` — test cases for traversal-above-root paths
- `PathMatchingFilterChainResolverTest` — integration test for the fallback
## Impact
Without this fix, any application where the servlet container passes
unnormalized paths to filters (some containers/configurations, or through
`RequestDispatcher.forward/include`) is vulnerable to complete Shiro filter
chain bypass via path traversal above root.
This is a Patch Rewards Program submission that removes an entire class of
authentication bypass vulnerabilities caused by null path propagation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
