CVE-2016-6802

What it actually does

The vulnerability allows bypassing of intended servlet filters in Apache Shiro when a non-root servlet context path is used, resulting in unauthorized access to protected resources.

Why it matters to the business

Attackers can gain unauthorized access to application resources, potentially leading to data breaches or system compromise. The issue affects older deployments and remains relevant in unpatched environments despite low EPSS and no known ransomware usage.

How an attack unfolds

An attacker identifies a web application using a vulnerable version of Apache Shiro configured with a non-root servlet context path and sends crafted HTTP requests that evade the intended filter chain, granting direct access to protected endpoints without authentication or authorization.

How to fix it

Upgrade Apache Shiro to version 1.3.2 or later. For the listed affected packages, update envoy-ratelimit-fips (Chainguard) and envoy-ratelimit-fips-compat (Chainguard) to 0.0_git20231206-r1.

How to confirm the fix worked

Confirm Apache Shiro version is at least 1.3.2, review servlet context path configuration, and test that filters are enforced on all paths including non-root contexts.

Typical attack path

1. Scan for web applications using Apache Shiro prior to version 1.3.2 with non-root context paths
2. Craft HTTP requests designed to bypass servlet filters
3. Access restricted resources or functionality without proper credentials

How to detect it

Examine web server and application logs for requests reaching protected endpoints without corresponding authentication events or filter execution traces; correlate with unusual access patterns to non-root context resources.

What your security team should do

• Apply the fixed package versions or upgrade Shiro immediately given the 3668 days since publication
• Audit all deployments for non-root servlet context usage
• Implement additional access controls and monitoring around protected endpoints