{
  "Name": "Apache Shiro CVE-2016-4437 Information Disclosure Vulnerability",
  "Description": "Apache Shiro before 1.2.5, when a cipher key has not been configured for the \"remember me\" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.",
  "Product": "Apache-Shiro",
  "Homepage": "https://shiro.apache.org/",
  "DisclosureDate": "2016-06-07",
  "Author": "gobysec@gmail.com",
  "FofaQuery": "app=\"Apache-Shiro\" || header=\"rememberme=deleteMe\"",
  "GobyQuery": "app=\"Apache-Shiro\" || header=\"rememberme=deleteMe\"",
  "Level": "3",
  "Impact": "Allows remote attackers to execute arbitrary code or bypass intended access restrictions",
  "Recommendation": "Updates are available. http://shiro.apache.org/download.html",
  "References": [
    "http://packetstormsecurity.com/files/137310/Apache-Shiro-1.2.4-Information-Disclosure.html",
    "http://rhn.redhat.com/errata/RHSA-2016-2035.html",
    "http://rhn.redhat.com/errata/RHSA-2016-2036.html",
    "http://www.securityfocus.com/archive/1/538570/100/0/threaded",
    "http://www.securityfocus.com/bid/91024",
    "https://lists.apache.org/thread.html/ef3a800c7d727a00e04b78e2f06c5cd8960f09ca28c9b69d94c3c4c4@%3Cannouncements.aurora.apache.org%3E",
    "https://nvd.nist.gov/vuln/detail/CVE-2016-4437",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4437"
  ],
  "HasExp": true,
  "ExpParams": [{
                  "name": "AttackType",
                  "type": "select",
                  "value": "cmd,goby_shell_linux"
            },{
                  "name": "cmd",
                  "type": "input",
                  "value": "whoami",
					"show": "AttackType=cmd"
            },
			{
                  "name": "CMDEncode",
                  "type": "select",
                  "value": "echo,none,bashBase64",
				"show": "AttackType=cmd"
            }],
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": null,
  "ExploitSteps": null,
  "Tags": ["rce"],
  "CVEIDs": [
    "CVE-2016-4437"
  ],
  "CVSSScore": "8.1",
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": null
  }
}