{"uuid": "8cd6ff80-54d9-495a-9dd2-68da79775212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2016-4437", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/shiro_rememberme_v124_deserialize.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"L / l-codes \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This vulnerability allows remote attackers to execute arbitrary code on vulnerable\\n          installations of Apache Shiro v1.2.4. Note that other versions of Apache Shiro may\\n          also be exploitable if the encryption key used by Shiro to encrypt rememberMe\\n          cookies is known.\\n\\n          The gadget chain used for Java deserialization must be present on the target's classpath.\", \"disclosure_date\": \"2016-06-07\", \"fullname\": \"exploit/multi/http/shiro_rememberme_v124_deserialize\", \"is_install_path\": true, \"mod_time\": \"2026-05-05 17:12:22 +0000\", \"name\": \"Apache Shiro v1.2.4 Cookie RememberME Deserial RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/shiro_rememberme_v124_deserialize.rb\", \"platform\": \"Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/shiro_rememberme_v124_deserialize\", \"references\": [\"CVE-2016-4437\", \"URL-https://github.com/Medicean/VulApps/tree/master/s/shiro/1\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix Command payload\", \"Windows Command payload\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:11.466239Z"}