leanworld7-netizen opened a new issue, #4472:
URL: https://github.com/apache/streampark/issues/4472
## Security Report: Shiro 1.10.0 CVEs + Unauthenticated Endpoints
### Summary
Apache StreamPark uses Apache Shiro 1.10.0 which is affected by
CVE-2023-22602 (authentication bypass when used with Spring Boot 2.6+).
Additionally, several paths are mapped as `anon` in ShiroConfig.java which may
expose sensitive endpoints.
### Finding 1: Shiro 1.10.0 — CVE-2023-22602
- **pom.xml**: `<shiro.version>1.10.0</shiro.version>`
- CVE-2023-22602: Authentication bypass via path traversal when Shiro <
1.11.0 is used with Spring Boot 2.6+
- Exploit: `GET /xxx/..;/actuator/env` bypasses Shiro auth and reaches
actuator endpoints
- Fix: Upgrade Shiro to 1.13.0+
### Finding 2: Unauthenticated `/actuator/**`
- **ShiroConfig.java L45**: `filterChainDefinitionMap.put("/actuator/**",
"anon");`
- Spring Boot Actuator endpoints are excluded from authentication
- If actuator is on classpath, `/actuator/env` exposes environment variables
and secrets
### Finding 3: Unauthenticated `/h2-console/**`
- **ShiroConfig.java L46**: `filterChainDefinitionMap.put("/h2-console/**",
"anon");`
- H2 database console accessible without auth
### Finding 4: Unauthenticated `/proxy/**`
- **ShiroConfig.java L77**: `filterChainDefinitionMap.put("/proxy/**",
"anon");`
- Proxy endpoint excluded from auth — potential SSRF
### Finding 5: FlinkShimsProxy Deserialization
- **FlinkShimsProxy.java L120-122**:
`ClassLoaderObjectInputStream.readObject()` with no ObjectInputFilter
- Potential deserialization RCE if input is user-controlled
### Remediation
1. Upgrade Shiro to 1.13.0+ (fixes CVE-2023-22602 and CVE-2023-46750)
2. Remove `/actuator/**` and `/h2-console/**` anon mappings for production
3. Investigate `/proxy/**` endpoint for SSRF
4. Add ObjectInputFilter to ClassLoaderObjectInputStream
This is a responsible disclosure per Apache security policy. If there is a
private security reporting channel, please advise.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
