Apache Shiro Jakarta EE Module Open Redirect Vulnerability via Unvalidated HTTP Referer Header

A vulnerability in the Apache Shiro Jakarta EE module allows for open redirection attacks. The issue arises from the module's use of the HTTP Referer header to determine redirect targets after user login. In versions 2.0-alpha through 2.2.0 and 3.0.0-alpha-1, the module fails to properly validate this client-controlled header, enabling attackers to manipulate redirect destinations in affected applications.

Impact

Exploitation of this vulnerability could lead to open redirect attacks, where users are redirected to untrusted sites, potentially causing phishing or other malicious outcomes.

Remediation

Users can upgrade to Apache Shiro version 2.2.1 or 3.0.0-alpha-2 or later. These versions address the vulnerability by validating the Referer header and restricting redirects to relative paths within the current application context.