Remote code execution in Oracle WebLogic Server

1) Insecure deserialization

EUVDB-ID: #VU18354

Risk: High

CVSSv4.0: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2019-2725

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to insecure deserialization of untrusted data within the "wls9_async_response.war" and "wls-wsat.war" components. A remote non-authenticated attacker can send a specially crafted HTTP request to "/_async/*" and "/wls-wsat/*" URLs and execute arbitrary code on the target system.

Mitigation

Install patch from vendor's website.

Vulnerable software versions

Oracle WebLogic Server: 10.3.6.0.0 - 12.2.1.3.0

CPE2.3

• cpe:2.3:a:oracle:oracle_weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:oracle_weblogic_server:12.1.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:oracle_weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*

External links

https://medium.com/@knownseczoomeye/knownsec-404-team-oracle-weblogic-deserialization-rce-vulnerability-0day-alert-90dd9a79ae93
https://www.cnvd.org.cn/webinfo/show/4989
https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.