Overview
About vulnerability
Impact
Authentication Bypass: A vulnerability exists in Apache Shiro that allows authentication bypass for static files when served from a case-insensitive filesystem (such as the default configuration on macOS or Windows).
The issue arises when Shiro’s URL filters are configured with lower-case rules (a common default), but the underlying operating system treats mixed-case filenames as identical. An attacker can access protected static resources by varying the capitalization of the filename in the request (e.g., requesting /SECRET.TXT to bypass a rule for /secret.txt).
This issue specifically affects static file handling and does not impact dynamic resource paths that are case-sensitive.
Patches
Users should upgrade to Apache Shiro 2.1.0 or later.
Important Configuration Note: Version 2.1.0 introduces a new configuration parameter to handle case-insensitivity, which must be enabled manually to resolve the issue:
- shiro.ini:
filterChainResolver.caseInsensitive = true
- Spring Boot (application.properties):
shiro.caseInsensitive=true
Note: Apache Shiro 3.0.0 (upcoming) will enable this setting by default.
Workarounds
- Ensure that the filesystem hosting the application is case-sensitive (e.g., Linux/Unix).
- Manually configure all Shiro filter chains to handle all possible case variations of protected filenames (not recommended due to complexity).
Resources
Details
- Affected product:
- Spring , activemq , shiro , shiro-config-core , shiro-core , shiro-crypto-core , shiro-lang , shiro-spring , shiro-web
- Affected packages:
- shiro-spring @ 1.13.0 (+208 more)