CVE-2023-25753

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-25753
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25753.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-25753
Aliases
Published
2023-10-19T08:35:24.075Z
Modified
2026-07-15T01:49:04.833517080Z
Summary
Server-Side Request Forgery in Apache ShenYu
Details

There exists an SSRF (Server-Side Request Forgery) vulnerability located at the /sandbox/proxyGateway endpoint. This vulnerability allows us to manipulate arbitrary requests and retrieve corresponding responses by inputting any URL into the requestUrl parameter.

Of particular concern is our ability to exert control over the HTTP method, cookies, IP address, and headers. This effectively grants us the capability to dispatch complete HTTP requests to hosts of our choosing.

This issue affects Apache ShenYu: 2.5.1.

Upgrade to Apache ShenYu 2.6.0 or apply patch  https://github.com/apache/shenyu/pull/4776  .

Database specific 
{
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "apache",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25753.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "2.5.1"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/apache/shenyu

Affected ranges

Type
GIT
Repo
https://github.com/apache/shenyu
Events
Introduced
52f7f77d35a42fc66be544ae10b9337ecd1c8739
Last affected
52f7f77d35a42fc66be544ae10b9337ecd1c8739
Database specific 
{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:apache:shenyu:2.5.1:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.5.1"
        },
        {
            "last_affected": "2.5.1"
        }
    ]
}

Affected versions

2.*
2.5.1
v2.*
v2.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-25753.json"