PT-2026-24894 · Perfree · Go-Fastdfs-Web

Din4 + 1 · Publicado 2026-03-11 · Atualizado 2026-03-12 · CVE-2026-3963

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions perfree go-fastdfs-web versions through 1.3.7

Description A security issue has been identified in the rememberMeManager function within the Apache Shiro RememberMe component of perfree go-fastdfs-web. This function, located in the file src/main/java/com/perfree/config/ShiroConfig.java, utilizes a hard-coded cryptographic key. This allows for remote attacks, though the complexity is considered high and exploitability is reported as difficult. The exploit for this issue has been publicly released. The vendor was notified but did not respond.

Recommendations Versions through 1.3.7 should be updated to a newer, secure version as soon as it becomes available. As a temporary workaround, consider disabling the RememberMe functionality within the Apache Shiro configuration until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-320

CWE-321

Identificadores relacionados

CVE-2026-3963

Produtos afetados

Go-Fastdfs-Web

Referências · 8

• 🔥 https://notion.so/go-fastdfs-web-Hardcoded-Apache-Shiro-Cipher-Key-reach-RCE-313ea92a3c41806fae44dffe53e69751 · Exploit
• https://twitter.com/cyberbivash/status/2031902261090177278 · Publicação no Twitter
• https://vuldb.com/?id.350392 · Nota
• https://vuldb.com/?ctiid.350392 · Nota
• https://vuldb.com/?submit.768282 · Nota
• https://twitter.com/CVEnew/status/2031992360180334963 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-3963 · Nota de Segurança
• https://t.me/CVEtracker/47200 · Publicação no Telegram