Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
CriticalCISA KEVExploited in the wildPublic exploit

Apache Shiro rememberMe deserialization RCE / auth bypass

IdentifiersCVE-2016-4437CWE-502

CVE-2016-4437 affects Apache Shiro before 1.2.5. When the framework's rememberMe feature is enabled and no custom cipher key has been configured, deployments may rely on the known default/hardcoded AES key used by CookieRememberMeManager. Shiro serializes the rememberMe object, encrypts it with AES, and Base64-encodes it into the rememberMe cookie. An unauthenticated remote attacker who knows the key can craft a malicious serialized Java object, encrypt it into a rememberMe cookie value, and submit it to the application. On deserialization, this can trigger arbitrary code execution via a suitable gadget chain. The same weakness can also permit bypass of intended access restrictions by forging rememberMe state.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can lead to unauthenticated remote code execution in the context of the affected application server, with resulting compromise of confidentiality, integrity, and availability. Depending on the application's privileges and environment, this may enable webshell deployment, malware installation, credential access, lateral movement, or full takeover of the underlying host. In some cases, attackers may also forge rememberMe state to bypass intended authentication or authorization restrictions.

Mitigation

If you can’t patch tonight, do this now.

If immediate upgrade is not possible, disable the rememberMe feature or the CookieRememberMeManager where business requirements allow. Ensure internet-facing Shiro applications are not exposed unnecessarily, restrict access with network controls/WAF rules where feasible, and monitor for suspicious rememberMe cookie values or repeated deserialization probes. Invalidate existing rememberMe cookies after changing keys. Reducing available gadget chains in the runtime and hardening the Java environment may lower exploit reliability, but these are compensating controls only and do not replace patching or secure key configuration.

Remediation

Patch, then assume compromise.

Upgrade Apache Shiro to 1.2.5 or later. Configure a unique, strong application-specific cipher key for the rememberMe feature rather than relying on any default or example key material. Review application code and configuration for unsafe rememberMe usage, remove vulnerable example configurations, and rotate any previously used rememberMe keys. Because key rotation invalidates existing rememberMe cookies, coordinate rollout across all nodes in clustered deployments. Also review the application classpath for exploitable deserialization gadget libraries and remove unnecessary ones where possible.
PUBLIC EXPLOITS

Exploits

2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 2 / 3 TOTALView more in app
Awesome_shiroMaturityPoCVerified exploit

This repository is a comprehensive exploitation toolkit for Apache Shiro <= 1.2.4 (CVE-2016-4437), focusing on the 'rememberMe' deserialization vulnerability. It provides multiple Python scripts for different attack stages: key/module brute-forcing (shiro_crack.py, shiro_piliang_crack.py), remote code execution (shiro-rce/shiro_rce.py, shiro_shuyu/shiro_rce.py), reverse shell access (shiro_getshell/shiro_getshell.py), and detection/fuzzing (fuzz-shiro/check_shiro.py, thread_check.py). The core technique is to generate malicious serialized Java objects (using ysoserial.jar) encrypted with various known Shiro keys, and deliver them via the 'rememberMe' cookie in HTTP requests. The toolkit supports both single-target and batch exploitation, and includes modules for different gadget chains (CommonsBeanutils1, CommonsCollections1-6, JRMPClient). The repository is operational and can be used to achieve full remote code execution and shell access on vulnerable Shiro deployments.

bkfishDisclosed May 27, 2020pythonnetwork
shisoserialMaturityPoCVerified exploit

This repository provides a Python-based exploit tool ('shisoserial.py') targeting Apache Shiro deserialization vulnerabilities, specifically CVE-2016-4437. The tool can: - Check if a target web application is using the Shiro framework by probing for the 'rememberMe' cookie behavior. - Brute-force the Shiro encryption key using a built-in dictionary ('lib/shiro_keys.txt') or a user-supplied key. - Generate and deliver ysoserial-based Java deserialization payloads (using either CBC or GCM encryption) to exploit vulnerable Shiro instances, enabling remote command execution (default command: 'whoami', customizable by the user). - Support batch targeting via a file of URLs, proxy configuration, POST/GET methods, and multithreading for mass exploitation. The main entry point is 'shisoserial.py', which implements all exploit logic and command-line parsing. The repository also includes documentation in both English and Chinese, a requirements file for dependencies, and a list of common Shiro keys. The attack vector is network-based, targeting web applications over HTTP/HTTPS. The tool is operational and provides real exploitation capabilities, not just detection.

4nth0ny1130Disclosed Dec 23, 2021pythonnetwork
EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
Apache Software FoundationAuroraapplication
Apache Software FoundationShiroapplication
Red HatFuseapplication
Red HatJboss Middleware Text-Only Advisoriesapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence2

Every observed campaign linking this CVE to a named adversary.

Associated malware6

Malware families riding this exploit, with evidence and IOCs.

Detection signatures1

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.