CVE-2020-13933
HIGHApache Shiro < 1.6.0 - Authentication Bypass via Specially Crafted HTTP Request
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2020-13933. PoCs published by EXP-Docs, JAckLosingHeart, 0xkami.
AI-analyzed exploit summary This repository contains a proof-of-concept for CVE-2020-13933, an authentication bypass vulnerability in Apache Shiro versions before 1.6.0. The exploit leverages a discrepancy in path normalization between Shiro and Spring, allowing attackers to bypass authentication by using a semicolon in the URL path.
Description
Apache Shiro before 1.6.0, when using Apache Shiro, a specially crafted HTTP request may cause an authentication bypass.
Exploits (4)
This repository contains a proof-of-concept for CVE-2020-13933, an authentication bypass vulnerability in Apache Shiro versions before 1.6.0. The exploit leverages a discrepancy in path normalization between Shiro and Spring, allowing attackers to bypass authentication by using a semicolon in the URL path.
This repository contains a functional proof-of-concept for CVE-2020-13933, an authentication bypass vulnerability in Apache Shiro. The code demonstrates a misconfiguration in Shiro's URL path matching, allowing unauthorized access to protected endpoints.
This repository contains a writeup for CVE-2020-13933, an Apache Shiro authentication bypass vulnerability. It references a blog post for environment setup and exploitation steps but does not include actual exploit code.
This repository contains a functional proof-of-concept for CVE-2020-13933, an authentication bypass vulnerability in Apache Shiro versions before 1.6.0. The exploit leverages URL-encoded semicolons to bypass authentication checks in Shiro's path normalization logic.
References (16)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N