CVE-2020-11989 PoC — Apache Shiro 授权问题漏洞

Source

https://github.com/HYWZ36/HYWZ36-CVE-2020-11989-code

Associated Vulnerability

Title:Apache Shiro 授权问题漏洞 (CVE-2020-11989)
Description:Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

Readme

# HYWZ36-CVE-2020-11989-code

File Snapshot


 [4.0K]  /data/pocs/7a28316770bb75b4859458124320f263d87eebba
├── [  28]  README.md
├── [4.0K]  springboot-shiro-master
│   ├── [2.6K]  pom.xml
│   ├── [4.0K]  src
│   │   ├── [4.0K]  main
│   │   │   ├── [4.0K]  java
│   │   │   │   └── [4.0K]  org
│   │   │   │       └── [4.0K]  syclover
│   │   │   │           └── [4.0K]  srpingbootshiro
│   │   │   │               ├── [1.1K]  LoginController.java
│   │   │   │               ├── [ 819]  MyRealm.java
│   │   │   │               ├── [1.2K]  ShiroConfig.java
│   │   │   │               └── [1.1K]  SrpingbootShiroApplication.java
│   │   │   └── [4.0K]  resources
│   │   │       └── [ 289]  application.properties
│   │   └── [4.0K]  test
│   │       └── [4.0K]  java
│   │           └── [4.0K]  org
│   │               └── [4.0K]  syclover
│   │                   └── [4.0K]  srpingbootshiro
│   │                       └── [ 238]  SrpingbootShiroApplicationTests.java
│   ├── [ 10K]  srpingboot-shiro.iml
│   └── [4.0K]  target
│       ├── [4.0K]  classes
│       │   ├── [ 403]  application.properties
│       │   └── [4.0K]  org
│       │       └── [4.0K]  syclover
│       │           └── [4.0K]  srpingbootshiro
│       │               ├── [1.9K]  LoginController.class
│       │               ├── [1.5K]  MyRealm.class
│       │               ├── [2.0K]  ShiroConfig.class
│       │               └── [1.3K]  SrpingbootShiroApplication.class
│       ├── [4.0K]  maven-archiver
│       │   └── [  75]  pom.properties
│       ├── [4.0K]  maven-status
│       │   └── [4.0K]  maven-compiler-plugin
│       │       ├── [4.0K]  compile
│       │       │   └── [4.0K]  default-compile
│       │       │       ├── [ 203]  createdFiles.lst
│       │       │       └── [ 487]  inputFiles.lst
│       │       └── [4.0K]  testCompile
│       │           └── [4.0K]  default-testCompile
│       │               ├── [  67]  createdFiles.lst
│       │               └── [ 138]  inputFiles.lst
│       ├── [4.0K]  srpingboot-shiro-0.0.1-SNAPSHOT
│       │   └── [4.0K]  WEB-INF
│       │       ├── [4.0K]  classes
│       │       │   ├── [   1]  application.properties
│       │       │   └── [4.0K]  org
│       │       │       └── [4.0K]  syclover
│       │       │           └── [4.0K]  srpingbootshiro
│       │       │               ├── [1.8K]  LoginController.class
│       │       │               ├── [1.5K]  MyRealm.class
│       │       │               ├── [2.0K]  ShiroConfig.class
│       │       │               └── [1.3K]  SrpingbootShiroApplication.class
│       │       └── [4.0K]  lib
│       │           ├── [ 66K]  classmate-1.5.1.jar
│       │           ├── [241K]  commons-beanutils-1.9.4.jar
│       │           ├── [575K]  commons-collections-3.2.2.jar
│       │           ├── [ 37K]  encoder-1.2.2.jar
│       │           ├── [1.1M]  hibernate-validator-6.0.18.Final.jar
│       │           ├── [ 66K]  jackson-annotations-2.10.3.jar
│       │           ├── [341K]  jackson-core-2.10.3.jar
│       │           ├── [1.3M]  jackson-databind-2.10.3.jar
│       │           ├── [ 34K]  jackson-datatype-jdk8-2.10.3.jar
│       │           ├── [103K]  jackson-datatype-jsr310-2.10.3.jar
│       │           ├── [9.1K]  jackson-module-parameter-names-2.10.3.jar
│       │           ├── [ 24K]  jakarta.annotation-api-1.3.5.jar
│       │           ├── [ 90K]  jakarta.validation-api-2.0.2.jar
│       │           ├── [ 59K]  jboss-logging-3.4.1.Final.jar
│       │           ├── [4.5K]  jul-to-slf4j-1.7.30.jar
│       │           ├── [270K]  log4j-api-2.12.1.jar
│       │           ├── [ 17K]  log4j-to-slf4j-2.12.1.jar
│       │           ├── [284K]  logback-classic-1.2.3.jar
│       │           ├── [461K]  logback-core-1.2.3.jar
│       │           ├── [ 13K]  shiro-cache-1.5.2.jar
│       │           ├── [ 18K]  shiro-config-core-1.5.2.jar
│       │           ├── [ 43K]  shiro-config-ogdl-1.5.2.jar
│       │           ├── [405K]  shiro-core-1.5.2.jar
│       │           ├── [ 24K]  shiro-crypto-cipher-1.5.2.jar
│       │           ├── [ 11K]  shiro-crypto-core-1.5.2.jar
│       │           ├── [ 34K]  shiro-crypto-hash-1.5.2.jar
│       │           ├── [ 19K]  shiro-event-1.5.2.jar
│       │           ├── [ 50K]  shiro-lang-1.5.2.jar
│       │           ├── [ 39K]  shiro-spring-1.5.2.jar
│       │           ├── [152K]  shiro-web-1.5.2.jar
│       │           ├── [ 40K]  slf4j-api-1.7.30.jar
│       │           ├── [296K]  snakeyaml-1.25.jar
│       │           ├── [364K]  spring-aop-5.2.5.RELEASE.jar
│       │           ├── [669K]  spring-beans-5.2.5.RELEASE.jar
│       │           ├── [1023K]  spring-boot-2.2.6.RELEASE.jar
│       │           ├── [1.3M]  spring-boot-autoconfigure-2.2.6.RELEASE.jar
│       │           ├── [ 397]  spring-boot-starter-2.2.6.RELEASE.jar
│       │           ├── [ 403]  spring-boot-starter-json-2.2.6.RELEASE.jar
│       │           ├── [ 405]  spring-boot-starter-logging-2.2.6.RELEASE.jar
│       │           ├── [ 404]  spring-boot-starter-tomcat-2.2.6.RELEASE.jar
│       │           ├── [ 406]  spring-boot-starter-validation-2.2.6.RELEASE.jar
│       │           ├── [ 403]  spring-boot-starter-web-2.2.6.RELEASE.jar
│       │           ├── [1.2M]  spring-context-5.2.5.RELEASE.jar
│       │           ├── [1.4M]  spring-core-5.2.5.RELEASE.jar
│       │           ├── [276K]  spring-expression-5.2.5.RELEASE.jar
│       │           ├── [ 23K]  spring-jcl-5.2.5.RELEASE.jar
│       │           ├── [1.4M]  spring-web-5.2.5.RELEASE.jar
│       │           ├── [932K]  spring-webmvc-5.2.5.RELEASE.jar
│       │           ├── [3.2M]  tomcat-embed-core-9.0.33.jar
│       │           ├── [248K]  tomcat-embed-el-9.0.33.jar
│       │           └── [260K]  tomcat-embed-websocket-9.0.33.jar
│       ├── [ 19M]  srpingboot-shiro-0.0.1-SNAPSHOT.war
│       ├── [ 16M]  srpingboot-shiro-0.0.1-SNAPSHOT.war.original
│       ├── [4.0K]  surefire-reports
│       │   ├── [ 373]  org.syclover.srpingbootshiro.SrpingbootShiroApplicationTests.txt
│       │   └── [ 23K]  TEST-org.syclover.srpingbootshiro.SrpingbootShiroApplicationTests.xml
│       └── [4.0K]  test-classes
│           └── [4.0K]  org
│               └── [4.0K]  syclover
│                   └── [4.0K]  srpingbootshiro
│                       └── [ 588]  SrpingbootShiroApplicationTests.class
└── [4.0K]  springboot-shiro-master0
    ├── [2.6K]  pom.xml
    ├── [4.0K]  src
    │   ├── [4.0K]  main
    │   │   ├── [4.0K]  java
    │   │   │   └── [4.0K]  org
    │   │   │       └── [4.0K]  syclover
    │   │   │           └── [4.0K]  srpingbootshiro
    │   │   │               ├── [1.1K]  LoginController.java
    │   │   │               ├── [ 819]  MyRealm.java
    │   │   │               ├── [1.2K]  ShiroConfig.java
    │   │   │               └── [1.1K]  SrpingbootShiroApplication.java
    │   │   └── [4.0K]  resources
    │   │       └── [ 289]  application.properties
    │   └── [4.0K]  test
    │       └── [4.0K]  java
    │           └── [4.0K]  org
    │               └── [4.0K]  syclover
    │                   └── [4.0K]  srpingbootshiro
    │                       └── [ 238]  SrpingbootShiroApplicationTests.java
    ├── [ 10K]  srpingboot-shiro.iml
    └── [4.0K]  target
        ├── [4.0K]  classes
        │   ├── [ 403]  application.properties
        │   └── [4.0K]  org
        │       └── [4.0K]  syclover
        │           └── [4.0K]  srpingbootshiro
        │               ├── [1.9K]  LoginController.class
        │               ├── [1.5K]  MyRealm.class
        │               ├── [2.0K]  ShiroConfig.class
        │               └── [1.3K]  SrpingbootShiroApplication.class
        ├── [4.0K]  maven-archiver
        │   └── [  75]  pom.properties
        ├── [4.0K]  maven-status
        │   └── [4.0K]  maven-compiler-plugin
        │       ├── [4.0K]  compile
        │       │   └── [4.0K]  default-compile
        │       │       ├── [ 203]  createdFiles.lst
        │       │       └── [ 487]  inputFiles.lst
        │       └── [4.0K]  testCompile
        │           └── [4.0K]  default-testCompile
        │               ├── [  67]  createdFiles.lst
        │               └── [ 138]  inputFiles.lst
        ├── [4.0K]  srpingboot-shiro-0.0.1-SNAPSHOT
        │   └── [4.0K]  WEB-INF
        │       ├── [4.0K]  classes
        │       │   ├── [   1]  application.properties
        │       │   └── [4.0K]  org
        │       │       └── [4.0K]  syclover
        │       │           └── [4.0K]  srpingbootshiro
        │       │               ├── [1.8K]  LoginController.class
        │       │               ├── [1.5K]  MyRealm.class
        │       │               ├── [2.0K]  ShiroConfig.class
        │       │               └── [1.3K]  SrpingbootShiroApplication.class
        │       └── [4.0K]  lib
        │           ├── [ 66K]  classmate-1.5.1.jar
        │           ├── [241K]  commons-beanutils-1.9.4.jar
        │           ├── [575K]  commons-collections-3.2.2.jar
        │           ├── [ 37K]  encoder-1.2.2.jar
        │           ├── [1.1M]  hibernate-validator-6.0.18.Final.jar
        │           ├── [ 66K]  jackson-annotations-2.10.3.jar
        │           ├── [341K]  jackson-core-2.10.3.jar
        │           ├── [1.3M]  jackson-databind-2.10.3.jar
        │           ├── [ 34K]  jackson-datatype-jdk8-2.10.3.jar
        │           ├── [103K]  jackson-datatype-jsr310-2.10.3.jar
        │           ├── [9.1K]  jackson-module-parameter-names-2.10.3.jar
        │           ├── [ 24K]  jakarta.annotation-api-1.3.5.jar
        │           ├── [ 90K]  jakarta.validation-api-2.0.2.jar
        │           ├── [ 59K]  jboss-logging-3.4.1.Final.jar
        │           ├── [4.5K]  jul-to-slf4j-1.7.30.jar
        │           ├── [270K]  log4j-api-2.12.1.jar
        │           ├── [ 17K]  log4j-to-slf4j-2.12.1.jar
        │           ├── [284K]  logback-classic-1.2.3.jar
        │           ├── [461K]  logback-core-1.2.3.jar
        │           ├── [ 13K]  shiro-cache-1.5.2.jar
        │           ├── [ 18K]  shiro-config-core-1.5.2.jar
        │           ├── [ 43K]  shiro-config-ogdl-1.5.2.jar
        │           ├── [405K]  shiro-core-1.5.2.jar
        │           ├── [ 24K]  shiro-crypto-cipher-1.5.2.jar
        │           ├── [ 11K]  shiro-crypto-core-1.5.2.jar
        │           ├── [ 34K]  shiro-crypto-hash-1.5.2.jar
        │           ├── [ 19K]  shiro-event-1.5.2.jar
        │           ├── [ 50K]  shiro-lang-1.5.2.jar
        │           ├── [ 39K]  shiro-spring-1.5.2.jar
        │           ├── [152K]  shiro-web-1.5.2.jar
        │           ├── [ 40K]  slf4j-api-1.7.30.jar
        │           ├── [296K]  snakeyaml-1.25.jar
        │           ├── [364K]  spring-aop-5.2.5.RELEASE.jar
        │           ├── [669K]  spring-beans-5.2.5.RELEASE.jar
        │           ├── [1023K]  spring-boot-2.2.6.RELEASE.jar
        │           ├── [1.3M]  spring-boot-autoconfigure-2.2.6.RELEASE.jar
        │           ├── [ 397]  spring-boot-starter-2.2.6.RELEASE.jar
        │           ├── [ 403]  spring-boot-starter-json-2.2.6.RELEASE.jar
        │           ├── [ 405]  spring-boot-starter-logging-2.2.6.RELEASE.jar
        │           ├── [ 404]  spring-boot-starter-tomcat-2.2.6.RELEASE.jar
        │           ├── [ 406]  spring-boot-starter-validation-2.2.6.RELEASE.jar
        │           ├── [ 403]  spring-boot-starter-web-2.2.6.RELEASE.jar
        │           ├── [1.2M]  spring-context-5.2.5.RELEASE.jar
        │           ├── [1.4M]  spring-core-5.2.5.RELEASE.jar
        │           ├── [276K]  spring-expression-5.2.5.RELEASE.jar
        │           ├── [ 23K]  spring-jcl-5.2.5.RELEASE.jar
        │           ├── [1.4M]  spring-web-5.2.5.RELEASE.jar
        │           ├── [932K]  spring-webmvc-5.2.5.RELEASE.jar
        │           ├── [3.2M]  tomcat-embed-core-9.0.33.jar
        │           ├── [248K]  tomcat-embed-el-9.0.33.jar
        │           └── [260K]  tomcat-embed-websocket-9.0.33.jar
        ├── [ 19M]  srpingboot-shiro-0.0.1-SNAPSHOT.war
        ├── [ 16M]  srpingboot-shiro-0.0.1-SNAPSHOT.war.original
        ├── [4.0K]  surefire-reports
        │   ├── [ 373]  org.syclover.srpingbootshiro.SrpingbootShiroApplicationTests.txt
        │   └── [ 23K]  TEST-org.syclover.srpingbootshiro.SrpingbootShiroApplicationTests.xml
        └── [4.0K]  test-classes
            └── [4.0K]  org
                └── [4.0K]  syclover
                    └── [4.0K]  srpingbootshiro
                        └── [ 588]  SrpingbootShiroApplicationTests.class

74 directories, 159 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!