CVE-2016-4437

Apache Shiro versions before 1.2.5 use a hard-coded default cryptographic key (CWE-321) to encrypt the 'remember me' session cookie when administrators have not configured their own key. A remote attacker who knows this default key can craft a malicious remember-me cookie/request parameter containing a crafted serialized Java object, triggering unsafe deserialization that yields arbitrary code execution or a bypass of the application's access restrictions. Successful exploitation gives an unauthenticated attacker control over the affected Java application with the privileges of the application process. Any application embedding a vulnerable Apache Shiro version is affected, including Apache Shiro directly, Apache Aurora, and Red Hat Fuse/JBoss Middleware products that bundle it. The flaw is confirmed exploited in the wild (listed in CISA KEV since 2021-11-03) with a very high predicted exploitation likelihood (EPSS 93.0%, 100th percentile), and a public proof-of-concept exploit is available.

What to do: Upgrade Apache Shiro to 1.2.5 or later, applying the latest available vendor release; if upgrading is not immediately possible, configure a unique, strong cipher key for the remember-me feature rather than relying on the built-in default. Inventory applications that embed Shiro — including Red Hat Fuse, JBoss Middleware, and Apache Aurora deployments — and apply the vendor advisory updates required by the CISA KEV listing. Verify that no deployed application still uses the default remember-me key and monitor for exploitation attempts against internet-facing Java services.