CVE-2016-4437

What it actually does

Unauthenticated deserialization of attacker-controlled data in the rememberMe cookie when the default encryption key is in use, permitting arbitrary Java object instantiation and code execution or authentication bypass.

Why it matters to the business

Attackers can fully compromise affected Apache Shiro applications, leading to data theft, service disruption, and lateral movement; the issue remains actively exploited in the wild with a CISA remediation deadline that has passed, increasing urgency for organizations using the library.

How an attack unfolds

An attacker generates a malicious serialized object, encrypts it under Shiro's default rememberMe key, places the payload in the rememberMe cookie, and sends a crafted request to the target application; successful deserialization executes the payload, granting code execution or bypassing access controls. Groups such as StrikeShark have leveraged this technique against unpatched deployments.

How to fix it

Upgrade Apache Shiro to version 1.2.5 or later (GIT commit bf1e04fca099ca6fd1a9a16da1aea04a5bb8f404); configure a unique, strong cipher key for the rememberMe feature; apply the exact fixed versions listed for each affected package such as apache/shiro (GIT) and apache/aurora (GIT).

How to confirm the fix worked

Verify the deployed Shiro version is at least 1.2.5, confirm a custom rememberMe cipher key is configured in shiro.ini or equivalent, and re-test authentication flows with crafted cookies to ensure deserialization no longer occurs.

Typical attack path

1. Identify an application using Apache Shiro < 1.2.5 with the default rememberMe cipher key
2. Craft a malicious Java serialized object containing attacker-controlled commands
3. Encrypt the object using the known default key and embed it in a rememberMe cookie
4. Send the cookie in an HTTP request to a Shiro-protected endpoint
5. Trigger deserialization to achieve remote code execution or session impersonation

How to detect it

Review web server and application logs for requests containing unusually long or base64-encoded rememberMe cookie values; search authentication and deserialization error logs for unexpected object types or class-not-found exceptions; correlate with threat intelligence on StrikeShark activity.

• rememberMe cookie values beginning with a fixed base64 prefix associated with the default AES key
• Java deserialization stack traces referencing org.apache.shiro in access or error logs
• Process execution of unexpected commands immediately following Shiro authentication endpoints

What your security team should do

• Immediately upgrade all Apache Shiro instances to the fixed versions provided for each package
• Replace any default rememberMe cipher keys with cryptographically strong, unique values
• Prioritize remediation for internet-facing applications given KEV status and observed exploitation by StrikeShark
• Add runtime application self-protection or WAF rules to block suspicious serialized payloads in cookies