| عنوان | perfree go-fastdfs-web ≤1.3.7 Hardcoded Apache Shiro Cipher Key |
|---|
| الوصف | A critical security vulnerability exists in go-fastdfs-web due to the use of a hardcoded AES encryption key in the Apache Shiro RememberMe functionality. This allows unauthenticated remote attackers to craft malicious serialized objects, encrypt them with the known key, and achieve Remote Code Execution (RCE) on the target server. |
|---|
| المصدر | ⚠️ https://www.notion.so/go-fastdfs-web-Hardcoded-Apache-Shiro-Cipher-Key-reach-RCE-313ea92a3c41806fae44dffe53e69751 |
|---|
| المستخدم | din4 (UID 50867) |
|---|
| ارسال | 26/02/2026 05:16 PM (7 أشهر منذ) |
|---|
| الاعتدال | 11/03/2026 01:58 PM (13 days later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 350392 [perfree go-fastdfs-web حتى 1.3.7 Apache Shiro RememberMe ShiroConfig.java rememberMeManager تشفير ضعيف] |
|---|
| النقاط | 15 |
|---|