CVE-2026-23903
📋 TL;DR
This CVE describes an authentication bypass vulnerability in Apache Shiro where attackers can access protected static files by changing the case of filenames in requests. It affects Apache Shiro versions before 2.0.7 when deployed on case-insensitive filesystems like macOS defaults. The vulnerability allows unauthorized access to files that should be protected by Shiro's security filters.
💻 Affected Systems
- Apache Shiro
📦 What is this software?
Shiro by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to sensitive static files containing credentials, configuration data, or proprietary information, potentially leading to full system compromise.
Likely Case
Unauthorized access to static files that should be protected, potentially exposing sensitive application resources or configuration files.
If Mitigated
No impact when proper case-insensitive filtering is enabled or when deployed on case-sensitive filesystems.
🎯 Exploit Status
Exploitation is straightforward - simply change case of filename in HTTP requests. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.7
Vendor Advisory: https://lists.apache.org/thread/5jjf0hnjcol58z2m5y255c7scz1lnp8k
Restart Required: Yes
Instructions:
1. Upgrade Apache Shiro to version 2.0.7 or later. 2. For Shiro 2.0.7, enable case-insensitive filtering by adding 'shiro.caseInsensitive=true' to application.properties or 'filterChainResolver.caseInsensitive = true' to shiro.ini. 3. Restart the application.
🔧 Temporary Workarounds
Enable case-insensitive filtering
allConfigure Shiro to use case-insensitive path matching for static files
Add to shiro.ini: filterChainResolver.caseInsensitive = true
Add to application.properties: shiro.caseInsensitive=true
Use case-sensitive filesystem
allDeploy application on case-sensitive filesystem
Format filesystem as case-sensitive (e.g., APFS case-sensitive on macOS)
🧯 If You Can't Patch
- Deploy on case-sensitive filesystem to prevent exploitation
- Implement web application firewall rules to block requests with mixed-case static file paths
🔍 How to Verify
Check if Vulnerable:
Check if Apache Shiro version is below 2.0.7 and application serves static files on case-insensitive filesystem with only lower-case filters configured.Check Version:
Check pom.xml for Maven: <version>2.0.7</version> or check application dependenciesVerify Fix Applied:
1. Verify Shiro version is 2.0.7 or higher. 2. Confirm caseInsensitive=true is set in configuration. 3. Test that static files cannot be accessed with different case variations.📡 Detection & Monitoring
Log Indicators:
- HTTP requests for static files with mixed-case filenames
- Access to protected static files without authentication
Network Indicators:
- HTTP requests with case variations of known static file paths
- Unusual access patterns to static resources
SIEM Query:
http.request.uri contains "." AND http.request.uri matches /[A-Z]/ AND http.response.status = 200