Apache Shenyu admin authentication bypass vulnerability (cve-2021-37580) analysis and protection measures

Apache ShenYu 2.3.0

Apache ShenYu 2.4.0

Fofa

fid="uPGDN6V9UWnc+KJdy5wdkQ=="

body=“id=“httpPath””&&body=“th:text=”${domain}""

Environment building

First clone a copy of the latest code from the official warehouse to the local , Then switch to related tag, Facilitate vulnerability analysis .

    git clone https://github.com/apache/incubator-shenyu.git

    git checkout v2.4.0