Apache Shiro deserialization vulnerability
2021-02-06 02:34:09,886 [http-bio-8000-exec-18] WARN [org.apache.shiro.mgt.DefaultSecurityManager] - Delegate RememberMeManager instance of type [org.apache.shiro.web.mgt.CookieRememberMeManager] threw an exception during getRememberedPrincipals().
org.apache.shiro.io.SerializationException: Unable to deserialze argument byte array.
at org.apache.shiro.io.DefaultSerializer.deserialize(DefaultSerializer.java:82)
at org.apache.shiro.mgt.AbstractRememberMeManager.deserialize(AbstractRememberMeManager.java:514)
1) The Apache Shiro framework provides a remember me function (RememberMe). After the user logs in successfully, an encrypted and encoded cookie will be generated. The key of the cookie is RememberMe, and the value of the cookie is formed by serializing the relevant information, then using aes to encrypt, and finally using base64 encoding.
When the cookie value is received on the server, it is analyzed and processed according to the following steps:
1. Retrieve the value of RememberMe cookie
2. Base 64 decoding
3. Use AES decryption (encryption key is hard-coded)
4. Deserialize (without filtering) deal with)
No filtering is performed when calling deserialization, which can trigger remote code execution vulnerabilities.
It means that shiro uses CookieRememberMeManager by default, and the process of processing cookies is: get the cookie value of rememberMe>>>Base64 decoding>>>AES decryption>>>deserialization. However, the AES key is hard-coded, which leads to an RCE vulnerability where an attacker can construct malicious data to cause deserialization.
2) Apache Shiro uses the public AES key to encrypt and transmit the server using the default AES key is vulnerable to deserialization attacks, and the attacker can execute arbitrary code on the server. Apache Shiro uses AES hard-coded secret keys in versions prior to 1.2.4, which has serious deserialization vulnerabilities. Attackers can execute arbitrary commands on remote hosts. It is recommended to check the Shiro version information. If <=1.2.4, please upgrade to 1.2.5 and above.
3), you can also customize the key to replace the default to avoid, the generated key code is as follows
-
//密钥生成java代码（直接拷贝到main允许即可） -
KeyGenerator keygen = KeyGenerator.getInstance("AES"); -
SecretKey deskey = keygen.generateKey(); -
System.out.println(Base64.encodeToString(deskey.getEncoded()));