CVE-2016-4437: Apache Shiro Code Execution Vulnerability
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
Other sources
Apache Shiro contains a vulnerability which may allow remote attackers to execute code or bypass intended access restrictions via an unspecified request parameter when a cipher key has not been configured for the "remember me" feature.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.shiro:shiro-coreto a version that resolves this vulnerability.Fixed in 1.2.5 - Upgrade
Upgrade
debian/shiroto a version that resolves this vulnerability.Fixed in 1.3.2-4+deb11u1Fixed in 1.3.2-5 - Upgrade
Upgrade
debian/shiroto a version that resolves this vulnerability.Fixed in 1.3.2-4+deb11u1 - Upgrade
Upgrade
debian/shiroto a version that resolves this vulnerability.Fixed in 1.3.2-5 - Configuration
Ensure a cipher key is configured for Shiro's 'remember me' feature (do not leave the cipher key unset). Set a secure, non-empty cipher key in your Shiro configuration so the remember-me functionality is not operating without a cipher key.
Apache Shiro 'remember me' feature cipher key = configured (non-empty, secret key)
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4437?
CVE-2016-4437 is classified as critical due to its potential to allow remote code execution.
How do I fix CVE-2016-4437?
To fix CVE-2016-4437, upgrade Apache Shiro to version 1.2.5 or later.
What versions of Apache Shiro are affected by CVE-2016-4437?
CVE-2016-4437 affects Apache Shiro versions prior to 1.2.5.
What can be exploited in CVE-2016-4437?
CVE-2016-4437 can be exploited to execute arbitrary code or bypass access restrictions without a configured cipher key.
Is CVE-2016-4437 limited to a specific platform?
CVE-2016-4437 affects the Apache Shiro framework across various platforms that utilize the vulnerable versions.