CVE-2023-25753

Server-Side Request Forgery in Apache ShenYu

State: Published
Severity: Not scored
Published: Oct 19, 2023
Updated: Sep 12, 2024
Reserved: Feb 13, 2023

Description

There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter.

Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing.

This issue affects Apache ShenYu: 2.5.1.

Upgrade to Apache ShenYu 2.6.0 or apply patch https://github.com/apache/shenyu/pull/4776 .

Scores

The record has no CVSS score.

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

Product	Versions
Apache ShenYuApache Software Foundation	2.5.1 and earlierAffected

References

https://lists.apache.org/thread/chprswxvb22z35vnoxv9tt3zknsm977dvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.