QID 730496

Date Published: 2022-05-25

QID 730496: Apache Shiro Remote Code Execution (RCE) Vulnerability

Apache Shiro is an open source software security framework that performs authentication, authorization, cryptography and session management.

CVE-2016-4437: Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Affected Versions:
Apache Shiro versions prior to 1.2.5

QID Detection Logic(Unauthenticated): This QID checks for vulnerable Apache Shiro by sending a specially crafted payload for command execution or make a query that will trigger Qualys Periscope detection mechanism.

Successful exploitation of this vulnerability may allow an unauthenticated attacker to execute arbitrary command on the target system.

CVSS V3 rated as Critical - 8.1 severity.

CVSS V2 rated as High - 6.8 severity.

Solution

Upgrade to Apache Shiro 1.2.5 or later to remediate this vulnerability.Workaround:
Either ensure a secret cipher key is configured, or disable the 'remember me' feature.

Vendor References

Apache Shiro Advisory - shiro.apache.org/security-reports.html#cve_2016_4437

CVEs related to QID 730496

CVE-2016-4437 |

Software Advisories

Advisory ID	Software	Component	Link
Apache Shiro Advisory			shiro.apache.org/security-reports.html#cve_2016_4437

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].