-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

CVE-2010-3863: Apache Shiro information disclosure vulnerability

Severity: Important

Vendor:
The Apache Software Foundation

Versions Affected:
Apache Shiro 1.0.0-incubating
The unsupported JSecurity 0.9.x versions are also affected

Description:
Shiro's path-based filter chain mechanism did not normalize request paths
before performing path-matching logic.  The result is that Shiro filter
chain matching logic was susceptible to potential path traversal attacks.

Mitigation:
All users should upgrade to 1.1.0

Example:
For a shiro.ini [urls] section entry:

/account/** = authc, ...
/** = anon

This states that all requests to the /account/** pages should be
authenticated (as indicated by the 'authc' (authentication) filter) in the
chain definition.

A malicious request could be sent:

GET /./account/index.jsp HTTP/1.1

And access would be granted because the path was not normalized to
/account/index.jsp before evaluating the path for a match.

Credit:
This issue was discovered by Luke Taylor of SpringSource.

References:
http://shiro.apache.org/configuration.html

Les Hazlewood
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (FreeBSD)

iQIcBAEBCgAGBQJM0F+ZAAoJEFWds0y8W3GbixQP/3f9UVJ1RQgEh+n8DQ82UxU6
NrFNJLXtXqzT/oxcTZUa5rxOsx1XZ2jXIt9X2c8nx9J+Ns4AfOGSdgq6Hj7+Cbgw
2Hc7t6oKpIFH5Tv4E6LHkYbKvDwvoD3U+CfactqDBqPYE10WQ7WNjvXyvm8bLgM6
+3ztqxmEREmg04FCDbErTmZXK59H6jhPHCttkYdw3mTQ9oM+v9cmL7c3NR3vXqoK
nwAtdmA24p1v05L9ptyiTuVWhoZKrru16jSI7wrz5Bj04ZqBHW5QSANo/SKQm6Gz
FZT74qi8XgTJnYhl0Ei9a4tPCiTKm2SUBOqZpcLd1d7S0WFlSUc+lgOT0Ze7NyFF
d9nkZcQyTSMf9Sh4mr62zdSvky3K1FNNgJ/EAdCc2xsHQRtuGJfvyBI4WidA9Cda
Ogg5v+J5/d/s5IYdmML4ffiv0Nah9BDX9SLi7FaxMphHmfA6unN85JWl2jrb6ij/
pRa2GR7pi6V6IxUdHETNpt+7YXU/zDibQCRPKlTAV54n2TK5tY5cVYpa3zw33ojL
aqPLV3U3nw2t7/wS/IMxnZ9vSdFV3ghlQn/YueQzrTeSMxshSQrdfT0T9pxa0Q0q
Db4wJRaX5W1uKurhQCa9zFnjU8xp97GobbThSRP7IHj0Fw1yVSCI7rXB5CHYpDSa
7MKcZauaP3nXPuAYVZBc
=fr+j
-----END PGP SIGNATURE-----