Executive brief
Apache Shiro is an authentication and authorization framework used to protect web applications. When integrated with Jakarta EE, a low-privileged user can manipulate HTTP requests to cause the server to connect to attacker-controlled URLs and transmit sensitive data, potentially leading to data exfiltration or server compromise.
Technical details
This vulnerability is a Server-Side Request Forgery (SSRF) in Apache Shiro's Jakarta EE integration module. A low-privileged user can craft a malicious HTTP request that forces the server to initiate an outbound connection to an attacker-controlled URL and transmit attacker-controlled data. The attack is specific to deployments using the Jakarta EE integration module and affects Shiro versions 2.x through 3.0.0. The vulnerability was patched in version 3.0.1, or can be mitigated by configuring the `org.apache.shiro.form-resubmit-host` and `org.apache.shiro.form-resubmit-port` system properties to restrict allowed connection targets.
Affected products
- Apache Shiro 2.x through 3.0.0
Timeline
- 2026-08-31: disclosed
- 2026-08-31: patched: Fixed in version 3.0.1