Apache ShenYu Admin Unauth Access

criticalseverity

9.1CVSS score

79%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache ShenYu suffers from an unauthorized access vulnerability where a user can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Apache ShenYu admin panel.

Fix

Upgrade to Apache ShenYu (incubating) 2.4.2 or apply the appropriate patch.

How to confirm it

Send: GET {{BaseURL}}/plugin
Positive when: contains "\"message\":\"query success\"" and "\"code\":200" AND status 200

Run it with nuclei: nuclei -id CVE-2022-23944 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-23944

info:
  name: Apache ShenYu Admin Unauth Access
  author: cckuakilong
  severity: critical
  description: Apache ShenYu suffers from an unauthorized access vulnerability where a user can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive information and potential compromise of the Apache ShenYu admin panel.
  remediation: Upgrade to Apache ShenYu (incubating) 2.4.2 or apply the appropriate patch.
  reference:
    - https://github.com/apache/incubator-shenyu/pull/2462
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23944
    - https://github.com/cckuailong/reapoc/blob/main/2022/CVE-2022-23944/vultarget/README.md
    - https://lists.apache.org/thread/dbrjnnlrf80dr0f92k5r2ysfvf1kr67y
    - http://www.openwall.com/lists/oss-security/2022/01/25/15
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2022-23944
    cwe-id: CWE-306,CWE-862
    epss-score: 0.79007
    epss-percentile: 0.99599
    cpe: cpe:2.3:a:apache:shenyu:2.4.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: shenyu
  tags: cve,cve2022,shenyu,unauth,apache,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/plugin"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"message":"query success"'
          - '"code":200'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from