CVE-2021-37580 PoC — Apache ShenYu Admin bypass JWT authentication

Source

https://github.com/Osyanina/westone-CVE-2021-37580-scanner

Associated Vulnerability

Title:Apache ShenYu Admin bypass JWT authentication (CVE-2021-37580)
Description:A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0

Description

A vulnerability scanner that detects CVE-2021-37580 vulnerabilities.

Readme

# westone-CVE-2021-37580-scanner  
Apache Shenyu is an extensible, high-performance and responsive API gateway solution applied to all micro service scenarios.  
An authentication bypass vulnerability exists in Apache Shenyu admin. The improper use of JWT in Shenyu admin bootstrap allows an attacker to bypass authentication, and the attacker can directly enter the system background through this vulnerability.  
# Installation & Usage  
git clone https://github.com/Osyanina/westone-CVE-2021-37580-scanner.git  
cd westone-CVE-2021-37580-scanner  
cmd CVE-2021-37580.exe  
# Repair suggestions  
Apache ShenYu 2.3.0   
Apache ShenYu 2.4.0

File Snapshot


 [4.0K]  /data/pocs/fedff2a37e61ede41dcd2aa29be13cf35270832e
└── [ 643]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!