认证机制不恰当

CVE编号

CVE-2022-23554

利用情况

暂无

补丁情况

N/A

披露时间

2022-12-29

漏洞描述

Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows Authentication Filter bypass. The AuthenticationFilter relies on the request URI to evaluate if the user is accessing the swagger endpoint. By accessing a URL with a path such as /api/foo;%2fapi%2fswagger the contains condition will hold and will return from the authentication filter without aborting the request. Note that the principal object will not be assigned and therefore the issue wont allow user impersonation. This issue has been fixed in version 1.10.4. There are no known workarounds.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/stevespringett/Alpine/blob/f03dbda46229c26145a5f9f7f2660cc...
https://github.com/stevespringett/Alpine/releases/tag/alpine-parent-1.10.4
https://securitylab.github.com/advisories/GHSL-2021-1010-Alpine/

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	alpine_project	alpine	*		Up to (excluding) 1.10.4

CVSS3评分 5.4

• 攻击路径 网络
• 攻击复杂度 低
• 权限要求 无
• 影响范围 未更改
• 用户交互 需要
• 可用性 无
• 保密性 低
• 完整性 低

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CWE-ID	漏洞类型
CWE-287	认证机制不恰当
CWE-697	不充分的比较

Exp相关链接

- avd.aliyun.com