Intel

CVE-2016-4437

Improper Access Control in Apache Shiro

criticalKEV: actively exploitedPoCEPSS 93%

Description

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

Source: OSVCISA_KEVCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

CVE-2016-4437 carries an EPSS score of 93 % at the 99.8th percentile, reflecting sustained, real-world exploitation activity despite the vulnerability's age — ungoverned Shiro deployments embedded in Java enterprise applications remain widespread. The attack requires no authentication and is executable via a single HTTP request with a crafted rememberMe cookie, placing it firmly in the low-complexity, network-accessible category (CVSS AV:N/AC:L). Organisations most at risk are those running Java web applications — internal portals, legacy ERP front-ends, API gateways — that depend on Shiro versions below 1.2.5 without an explicitly configured cipher key. NIS2-obligated operators of critical infrastructure should treat this as a critical finding and target patch deployment within 72 hours, using the cipher-key hardening and WAF controls above as immediate compensating measures.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the patch: Upgrade Apache Shiro to version 1.2.5 or later (Maven coordinate org.apache.shiro:shiro-core:1.2.5). All versions from 1.0.0-incubating through 1.2.4 are affected. Verify the current stable release in the Apache Shiro release repository before deploying.
  • Set a strong RememberMe cipher key immediately: Regardless of patch status, configure a random AES key (minimum 128 bit, preferably 256 bit) for securityManager.rememberMeManager.cipherKey in shiro.ini or your Spring/Guice configuration. Without an explicit key, Shiro falls back to a hardcoded default key that is publicly known and trivially exploitable.
  • Disable the RememberMe feature if it is not required by the application: set securityManager.rememberMeManager = org.apache.shiro.mgt.DisabledRememberMeManager and restart the application. This eliminates the attack surface entirely.
  • Inventory all affected deployments: Run a Maven dependency scan (mvn dependency:tree | grep shiro) or SBOM analysis across all Java application servers to identify every instance of a vulnerable Shiro version, including transitive dependencies.
  • Verify network exposure: Confirm that vulnerable Shiro endpoints are not directly reachable from the internet. Place a WAF or reverse proxy in front of any exposed instance if one is not already present.

Runbook · Step 2

Mitigation layers

  • WAF rule targeting the RememberMe cookie: Block or quarantine HTTP requests carrying a rememberMe cookie whose Base64-decoded value exceeds 256 bytes or contains unexpected binary structures. Suggested Snort pattern: alert http any any -> $HTTP_SERVERS any (msg:"CVE-2016-4437 Shiro RememberMe"; content:"rememberMe="; http_cookie; pcre:"/rememberMe=[A-Za-z0-9+\/]{200,}/"; sid:9164437; rev:1;).
  • JVM-level deserialization filtering: Deploy Java serialization filters (-Djdk.serialFilter) or a library such as SerialKiller or NotSoSerial to block known gadget chains (Commons Collections, Spring Framework, etc.) at the class level. This acts as a defence-in-depth layer independent of the Shiro patch.
  • Least-privilege for the application process: Run the application server under an OS account with minimal rights — no root/SYSTEM, no write access to critical directories. This limits the blast radius of a successful RCE.
  • Egress filtering: Restrict outbound connections from the application server to an explicit allowlist of destinations and ports. Most post-exploitation payloads (reverse shells, C2 beaconing) require outbound TCP to non-standard ports.
  • Secrets management for the cipher key: Do not store the cipher key in plaintext configuration files. Use a secrets manager (HashiCorp Vault, AWS Secrets Manager, or equivalent). Rotate the key after patch deployment, since a previously exposed key re-opens the vulnerability.

Runbook · Step 3

Detection rules

  • Web access log pattern: Requests carrying a rememberMe cookie that produce HTTP 4xx/5xx responses followed by a successful request (200/302) with the same or a similar cookie value — indicative of cipher-key brute-forcing or payload iteration. SPL: index=webserver sourcetype=access_combined | rex field=_raw "Cookie:.*rememberMe=(?<rm_cookie>[^;]+)" | stats count by rm_cookie, status | where count > 10 AND status IN ("200","302").
  • Suspicious process ancestry (EDR/Sysmon): Child processes of the JVM (e.g. java.exe or java) spawning shell interpreters (cmd.exe, powershell.exe, /bin/sh, /bin/bash) or network utilities (curl, wget, nc). Monitor Sysmon EID 1 or auditd execve syscalls where the parent PID belongs to the JVM process.
  • Network telemetry (Zeek/Suricata): Outbound connections from the application server to ports outside the defined allowlist — particularly TCP 4444 or high-numbered ports commonly used by reverse shells — or DNS queries to unknown external resolvers occurring shortly after a Shiro request.
  • JVM deserialization exceptions in application logs: Log entries containing java.io.InvalidClassException, ClassNotFoundException, or org.apache.shiro.crypto.CryptoException may indicate failed or probing exploit attempts. Sigma shape: keywords: ['CryptoException', 'rememberMe', 'InvalidClassException'] against the application log source.
  • Filesystem activity: New .class, .jar, or .jsp files appearing in the web root or temporary directories of the application server. Linux auditd rule: -w /opt/tomcat/webapps -p wa -k shiro_webshell.

Metrics

Severity
critical
Priority score
161.22
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
—
CVSS v3
—
CVSS v4
—
EPSS percentile
99.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
93.0 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2022-05-14 02:46 UTC
CWE
—

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • maven

    org.apache.shiro:shiro-core1.0.0-incubating

  • maven

    org.apache.shiro:shiro-core1.1.0

  • maven

    org.apache.shiro:shiro-core1.2.0

  • maven

    org.apache.shiro:shiro-core1.2.1

  • maven

    org.apache.shiro:shiro-core1.2.2

  • maven

    org.apache.shiro:shiro-core1.2.3

  • maven

    org.apache.shiro:shiro-core1.2.4

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2016-4437