Loading vulnerability…
CVE-2016-4437 is a critical vulnerability in Apache Shiro before 1.2.5 involving the rememberMe feature. When a deployment does not configure its own cipher key, the framework uses a known default key in CookieRememberMeManager to encrypt and decrypt rememberMe data. Because the rememberMe value is processed as a serialized Java object, an unauthenticated remote attacker who knows or can rely on the default key can craft a malicious serialized payload, encrypt it as a rememberMe token, and submit it to the application. On vulnerable deployments this can trigger unsafe deserialization and lead to arbitrary code execution. The flaw can also enable bypass of intended access restrictions through manipulation of rememberMe state.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository contains a single Metasploit module targeting Apache Shiro v1.2.4's deserialization vulnerability (CVE-2016-4437). The exploit leverages a weakness in the rememberMe cookie handling, where a known or guessable encryption key allows attackers to craft a malicious Java serialized payload. This payload is encrypted and placed in the rememberMe cookie, which is then sent via an HTTP request to the target application. If the target is vulnerable, the payload is deserialized and executed, resulting in remote code execution. The module supports both Unix and Windows command payloads, including reverse shells. The main entry point is the Ruby file implementing the Metasploit exploit logic. The only fingerprintable endpoints are the HTTP base path (TARGETURI) and the rememberMe cookie. The exploit is weaponized, as it is part of the Metasploit framework and supports customizable payloads.
This repository is a comprehensive exploitation toolkit for Apache Shiro <= 1.2.4 (CVE-2016-4437), focusing on the 'rememberMe' deserialization vulnerability. It provides multiple Python scripts for different attack stages: key/module brute-forcing (shiro_crack.py, shiro_piliang_crack.py), remote code execution (shiro-rce/shiro_rce.py, shiro_shuyu/shiro_rce.py), reverse shell access (shiro_getshell/shiro_getshell.py), and detection/fuzzing (fuzz-shiro/check_shiro.py, thread_check.py). The core technique is to generate malicious serialized Java objects (using ysoserial.jar) encrypted with various known Shiro keys, and deliver them via the 'rememberMe' cookie in HTTP requests. The toolkit supports both single-target and batch exploitation, and includes modules for different gadget chains (CommonsBeanutils1, CommonsCollections1-6, JRMPClient). The repository is operational and can be used to achieve full remote code execution and shell access on vulnerable Shiro deployments.
This repository provides a Python-based exploit tool ('shisoserial.py') targeting Apache Shiro deserialization vulnerabilities, specifically CVE-2016-4437. The tool can: - Check if a target web application is using the Shiro framework by probing for the 'rememberMe' cookie behavior. - Brute-force the Shiro encryption key using a built-in dictionary ('lib/shiro_keys.txt') or a user-supplied key. - Generate and deliver ysoserial-based Java deserialization payloads (using either CBC or GCM encryption) to exploit vulnerable Shiro instances, enabling remote command execution (default command: 'whoami', customizable by the user). - Support batch targeting via a file of URLs, proxy configuration, POST/GET methods, and multithreading for mass exploitation. The main entry point is 'shisoserial.py', which implements all exploit logic and command-line parsing. The repository also includes documentation in both English and Chinese, a requirements file for dependencies, and a list of common Shiro keys. The attack vector is network-based, targeting web applications over HTTP/HTTPS. The tool is operational and provides real exploitation capabilities, not just detection.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A known publicly exploitable vulnerability affecting Apache Shiro that attackers were observed scanning and exploiting in the StrikeShark campaign.
An Apache Shiro vulnerability listed as weaponized by the threat actor for access operations.
An Apache Shiro remote code execution vulnerability listed among those targeted in the campaign.
Apache Shiro rememberMe deserialization vulnerability caused by use of a hardcoded default AES key in vulnerable versions, enabling exploitation via crafted rememberMe cookies.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.