This is an automated email from the ASF dual-hosted git repository. Aias00 pushed a commit to branch fix/auth-security-bypass in repository https://gitbox.apache.org/repos/asf/shenyu.git
commit a83c05f94dc84f986225ca776ac0e636dfcbbc5c Author: liuhy <[email protected]> AuthorDate: Tue Jun 16 17:10:59 2026 +0800 [fix] Add missing permission annotations to /appAuth/updateSk and /sandbox/proxyGateway - Add @RequiresPermissions("system:authen:edit") to AppAuthController.updateSk() This endpoint was the only one in the controller without a permission check, allowing any authenticated user to rotate arbitrary appAuth secrets. - Change /appAuth/updateSk from GET to POST to prevent appSecret from appearing in URLs, browser history, and server access logs. - Add @RequiresPermissions("system:authen:list") to SandboxController.proxyGateway() This endpoint generates server-side signed requests using stored appSecrets. Without permission checks, any authenticated user could abuse it to forge signed requests after compromising an appKey via the updateSk vulnerability. These fixes address an authorization bypass where a low-privileged dashboard user could chain updateSk + proxyGateway to impersonate arbitrary application identities and send authenticated requests to allowlisted internal services. Co-Authored-By: Claude <[email protected]> --- shenyu-admin/src/http/http-debug-app-auth-controller-api.http | 7 +------ .../java/org/apache/shenyu/admin/controller/AppAuthController.java | 3 ++- .../java/org/apache/shenyu/admin/controller/SandboxController.java | 2 ++ .../org/apache/shenyu/admin/controller/AppAuthControllerTest.java | 2 +- 4 files changed, 6 insertions(+), 8 deletions(-) diff --git a/shenyu-admin/src/http/http-debug-app-auth-controller-api.http b/shenyu-admin/src/http/http-debug-app-auth-controller-api.http index be9a97abbc..ce08bd6de2 100644 --- a/shenyu-admin/src/http/http-debug-app-auth-controller-api.http +++ b/shenyu-admin/src/http/http-debug-app-auth-controller-api.http @@ -61,16 +61,11 @@ X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyTmFtZSI6ImFkbWluIiw } ### updateSk -GET http://localhost:9095/appAuth/updateSk?appKey=123&appSecret=123 +POST http://localhost:9095/appAuth/updateSk?appKey=123&appSecret=123 Accept: application/json Content-Type: application/json X-Access-Token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyTmFtZSI6ImFkbWluIiwiZXhwIjoxNjQ4NjUwMDg2fQ.aDeChT_Ey6FwYDdzSkc9ZLBHd5v-LVUZ6BPcYqJCo-Y -{ - "id": 123, - "name": "order" -} - ### app auth list by page GET http://localhost:9095/appAuth/findPageByQuery?currentPage=1&pageSize=10 Accept: application/json diff --git a/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/AppAuthController.java b/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/AppAuthController.java index d96d6839c7..e7e38a2ae6 100644 --- a/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/AppAuthController.java +++ b/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/AppAuthController.java @@ -82,7 +82,8 @@ public class AppAuthController implements PagedController<AppAuthQuery, AppAuthV * @param appSecret the app secret * @return the shenyu result */ - @GetMapping("/updateSk") + @PostMapping("/updateSk") + @RequiresPermissions("system:authen:edit") public ShenyuAdminResult updateSk(@RequestParam("appKey") @Existed(message = "app key not existed", provider = AppKeyProvider.class) final String appKey, diff --git a/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/SandboxController.java b/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/SandboxController.java index b717df6e6f..814a6ea9d2 100755 --- a/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/SandboxController.java +++ b/shenyu-admin/src/main/java/org/apache/shenyu/admin/controller/SandboxController.java @@ -20,6 +20,7 @@ package org.apache.shenyu.admin.controller; import org.apache.shenyu.admin.aspect.annotation.RestApi; import org.apache.shenyu.admin.model.dto.ProxyGatewayDTO; import org.apache.shenyu.admin.service.SandboxService; +import org.apache.shiro.authz.annotation.RequiresPermissions; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestBody; @@ -49,6 +50,7 @@ public class SandboxController { * @throws IOException throw io exception */ @PostMapping(path = "/proxyGateway") + @RequiresPermissions("system:authen:list") public void proxyGateway(@RequestBody @Valid final ProxyGatewayDTO proxyGatewayDTO, final HttpServletRequest request, final HttpServletResponse response) throws IOException { diff --git a/shenyu-admin/src/test/java/org/apache/shenyu/admin/controller/AppAuthControllerTest.java b/shenyu-admin/src/test/java/org/apache/shenyu/admin/controller/AppAuthControllerTest.java index 14244f643b..6889bce583 100644 --- a/shenyu-admin/src/test/java/org/apache/shenyu/admin/controller/AppAuthControllerTest.java +++ b/shenyu-admin/src/test/java/org/apache/shenyu/admin/controller/AppAuthControllerTest.java @@ -186,7 +186,7 @@ public final class AppAuthControllerTest { @Test public void testUpdateSk() throws Exception { - this.mockMvc.perform(MockMvcRequestBuilders.get("/appAuth/updateSk") + this.mockMvc.perform(MockMvcRequestBuilders.post("/appAuth/updateSk") .param("appKey", "testAppKey") .param("appSecret", "updateAppSecret")) .andExpect(status().isOk())
