修复Apache Shiro 默认密钥致命令执行漏洞（CVE-2016-4437）详细说明

一、升级jar包

    shiro需要升级到1.7.0

    shiro1.7.0的spring相关jar要求在4.0版本以上

    spring4.0以上版本要求jdk1.8.0以上

二、增加一个自定义秘钥代码

import org.apache.shiro.codec.Base64;
import org.apache.shiro.crypto.AbstractSymmetricCipherService;
import org.aspectj.apache.bcel.generic.IINC;
 
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
 
import java.security.Key;
import java.security.NoSuchAlgorithmException;
 
/**
 * shiro 秘钥生成器
 *
 * @author admin shiro有自己的随机生成秘钥的方法 秘钥生成器
 *
 *
 */
public class MySymmetricCipherService extends AbstractSymmetricCipherService {
 
 
 
    protected MySymmetricCipherService(String algorithmName) {
        super(algorithmName);
        // TODO Auto-generated constructor stub
    }
 
    public static byte[] generateNewKeyFromSuper() {
        KeyGenerator kg;
        try {
            kg = KeyGenerator.getInstance("AES");
        } catch (NoSuchAlgorithmException var5) {
            String msg = "Unable to acquire AES algorithm.  This is required to function.";
            throw new IllegalStateException(msg, var5);
        }
 
        kg.init(128);
        SecretKey key = kg.generateKey();
        byte[] encoded = key.getEncoded();
        return encoded;
    }
 
 
 
    /**
     * 使用shiro官方的生成
     * org.apache.shiro.crypto.AbstractSymmetricCipherService#generateNewKey()
     * @return
     */
    public static byte[] getCipherKey() {
        MySymmetricCipherService mySymmetricCipherService = new MySymmetricCipherService("AES");
        Key gKey = mySymmetricCipherService.generateNewKey();
        return gKey.getEncoded();
    }
 
    public static void main(String[] args) {
        MySymmetricCipherService mySymmetricCipherService = new MySymmetricCipherService("AES");
        Key gKey = mySymmetricCipherService.generateNewKey();
        System.out.println("key: " + gKey.getEncoded());
        System.out.println("key Base64.encodeToString: " + Base64.encodeToString(gKey.getEncoded()));
 
        byte[] decodeValue = org.apache.shiro.codec.Base64.decode("t0EWNQWKMXYzKTDSQpNNfg==");
        System.out.println("decodeValue: " + decodeValue);
    }
}

修改shiro配置

<!-- 定义Shiro安全管理配置 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="shiroDbRealm" />
        <property name="cacheManager" ref="cacheManager" />
        <!-- 加入rememberMe的配置管理 -->
        <property name="rememberMeManager" ref="rememberMeManager" />
    </bean>


    <!-- rememberMe管理器   -->
    <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
        <property name="cipherKey" value="#{T(com.**.realm.MySymmetricCipherService).getCipherKey()}" />
        <property name="cookie" ref="rememberMeCookie" />
    </bean>

    <!-- remenberMe配置 -->
    <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg value="rememberMe" />
        <property name="httpOnly" value="true" />
        <!-- 默认记住7天（单位：秒） -->
        <property name="maxAge" value="604800" />
    </bean>