CVE-2023-25753CWE-918

CVE-2023-25753: vulnerability in Apache ShenYu

Server-Side Request Forgery in Apache ShenYu

Published · Updated

Follow this CVE+ Monitor Apache ShenYu+ Monitor org.apache.shenyu:shenyu-common

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.1%
There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter. Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing. This issue affects Apache ShenYu: 2.5.1. Upgrade to Apache ShenYu 2.6.0 or apply patch  https://github.com/apache/shenyu/pull/4776  .
Affected products
Apache Software Foundation · Apache ShenYu
Related CVEs — Apache ShenYu

In the same product, most dangerous first.

CVE-2022-37435—Apache ShenYu Admin Improper Privilege ManagementEPSS 1.3%CVE-2022-42735HIGHApache ShenYu Admin ultra viresEPSS 1.2%