CVE-2022-21445-for-12.2.1.3.0-Weblogic

Pre-authentication remote code execution exploit for Oracle WebLogic ADF Faces (CVE-2022-21445, CVSS 9.8). Includes detailed environment setup, payload generation, and remote debugging instructions for penetration testing.

6. Create a new Oracle database account by following these steps:

• Terminal Administrator -> sqlplus / as sysdba
• Create system user: alter user system identified by system_password account unlock;
• Check existence of system user: select username from dba_users;
• Set environment: alter session set “_oracle_script”=true;
• Create regular user hr: create user hr identified by user_password;
• Grant privileges: grant all privileges to hr;
• Unlock account – change password: alter user hr identified by hr_pass account unlock;
• Create new system account: alter user sys identified by sys_pass account unlock;

Step 3: Install SQL Developer, no-jre version, download link: SQLDev-NoJRE

• Run sqldeveloper.application with administrator privileges.

• Configure parameters for a new connection as shown below, note to change Username and Password (as in the example above: hr), Hostname (default is localhost), Port (default is 1521), SID (the global database name installed in step 2).

• If when selecting Test you see a Success message, the connection is successful; then select Connect.

Step 4: Install Fusion Middleware Infrastructure (FMW) version 12.2.1.3.0, download link: FMW_ver_12.2.1.3.0

• Create a path for the FMW installation directory in the format: C:\Oracle\Middleware\Oracle_Home
• Follow the instructions step by step: FMW Installation Guide

Step 5: Install Oracle Business Intelligence (OBIEE) version 12.2.1.4.0, download link: OBIEE_ver_12.2.1.4.0

• Run setup_bi_platform-12.2.1.4.0_win64.exe with administrator privileges.

• Install step by step according to OBIEE Installation Guide

• Note: The BI path must match the FMW installation path, e.g., Oracle/Middleware/Oracle_Home.

Step 6: Set up BI Schema using the Repository Creation Utility (RCU)

• At the path C:\Oracle\Middleware\Oracle_Home\oracle_common\bin, run rcu.bat as administrator.

• Follow the steps below:

• Finally, click Create to let the system create the BI Schema.

Step 7: Set up environment variables for OBIEE

• Go to Control Panel > System > Advanced system settings > Advanced > Environment Variables > New System Variable

Step 8: Create BI Domain

1. At the path C:\Oracle\Middleware\Oracle_Home\bi\bin, run config.cmd as administrator.

2. In step 1: Select all 3 components, where Essbase is the OLAP server, Business Intelligence Enterprise Edition is BI Analytics, and Business Intelligence Publisher is BI Publisher.

3. In step 3: Configure a new domain as shown below, !! REMEMBER THE DOMAIN PASSWORD BECAUSE IT WILL BE VERY DIFFICULT TO RECOVER. Leave the domain as bi since it's the default.

4. In step 4: Update domain information for the Database.

5. In step 8: If the process goes smoothly, the result will be as shown below.

6. If everything is Done, save the OBIEE information file for the next step, log in to the URLs:

• http://localhost:9500/console*
• http://localhost:9500/em*
• http://localhost:9502/xmlpserver*
• http://localhost:9502/analytics*

7. Some possible errors:

• In step 4, if the system reports fail to logon, check the domain password for correctness.

• In step 8, if the system shows an error like the image below, check whether you have activated your Windows license and whether your Windows meets the requirements described.

• Error: BI_HOME_PRODUCT not added, review Step 7.
• Error update ...

Step 9: After setup, access the newly created BI domain at path $Oracle_Home\user_projects\domains\bi\servers\AdminServer\tmp_WL_user\adf.oracle.domain.webapp\i83uao

• Copy all jar files from here into a separate folder, share it to the attack machine (for lab environment do this; for real attacks, the attack machine must also have the same setup as the target to obtain the source code).

• Also add the coherence.jar library from $Oracle_Home\coherence\lib into this folder.

• This folder is crucial for payload success because each FMW or BI version or each machine's environment may differ, so the exact version is needed to minimize risks or exceptions during payload transmission.

Step 10 (only if remote debug is needed; again, if testing in a real environment, since you cannot freely set up the victim machine, the attacker must perform the target machine setup on their own machine to remote debug and check errors.)

• Install Mozilla, add Burp Proxy with port 8181.

• Enable Remote Debug on the BI server.

  Access localhost:9500/console

  In Domain Structure -> select bi -> Environment -> Servers

Two servers will appear: the Weblogic AdminServer and the BI bi_server1.

Click Lock & Edit in the upper left corner, select bi_server1 to edit its configuration. Then click Configuration -> Server start -> Scroll to the bottom, select Advanced (if present) -> Click to enter Arguments -> Enter the debug parameters:

-Xdebug -Xnoagent – Xrunjdwp:transport=dt_socket,address=5005,server=y,suspend=n

(you can try 0.0.0.0:5005 if later you encounter errors restarting bi_server1)

Enter the weblogic password (set earlier in the Config BI Domain step) -> Apply change & Restart.

Open Administrator terminal -> Navigate to $Oracle_Home\user_projects\domains\bi\bitools\bin run ./stop.cmd and ./start.cmd to restart bi_server1. During restart, if no errors occur, debug is enabled and listening on port 5005 as above. If there are errors, check the debug parameters for extra spaces or address issues.

Attack Machine Side

Step 1: Download IntelliJ IDEA Ultimate, activate using code found on GitHub.

Step 2 (Only do this step if the attack process throws errors like 500 Server Error, ... due to exceptions in the payload.)

1. Change the jdk/sdk version of the project to match the target machine (installation as in Target Machine - Step 1).

2. Create an empty project for source code analysis and remote debugging.

3. Add all jar files received from the target machine to this project:

   Project Structure -> Modules -> Click + -> 1 JARS or Directories -> Add the entire jar folder.

4. Set up Remote Debugging:

   Run -> Edit Configurations -> + -> Remote JVM Debug

Run Remote Debug; if a message appears in the console: Connected … then it's successful.

Step 3:

• Clone the code from this repository to your machine, delete the old coherence.jar in the lib folder and replace it with the file you received from the target machine in the previous step.

• Next, add it to a project in IntelliJ, add the jar files in lib with the option Add as library.

• Check the name of the class LambdaIdentity$.... for the correct Weblogic version; if there is a change, refactor the file and rename it.

  Weblogic 12.2.1.3: LambdaIdentity$E12ECA49F06D0401A9D406B2DCC7463A

  Weblogic 12.2.1.4: LambdaIdentity$423B02C050017B24DB10DFF759AA56BF

• Edit the path to the LambdaIdentity$....class file in Main.java. To get the exact path, there are two ways: You can run javac on the jar file to generate the .class file; another approach is to comment out the main function's code, then run the project normally; the class file path can be found in the target directory.

• Check that the jdk and sdk of the project match the target machine.

Analysis of BI Code and Payload Generation Code

Analysis of BI Code

1. At the path $Oracle\Middleware\Oracle_Home\user_projects\domains\bi\servers\AdminServer\tmp_WL_user\em\fw8wi5\war\WEB-INF

We see the web.xml file, which describes the servlet-mapping relationships. "resources" is a servlet related to system resources, containing important data and information; therefore, this is a location often targeted by attackers.

2. Dive into the ResourceServlet class, specifically org.apache.myfaces.trinidad.webapp.ResourceServlet, we see the doGet method responsible for handling GET requests sent to the server.

• Here, through the method _getResourceLoader(), a new loader is created from the input request. Also, a resourcePath is initialized and receives the servletPath and servletInfo values via the getResourcePath method with the request parameter. That loader calls the getResource(resourcePath) function, attempting to load the resource from the input request and find it through the function org.apache.myfaces.trinidad.resource.ResourceLoader.getResource.findResource(), finally the found value is passed to a url instance of the URL.class.

• _getResourceLoader maintains a ConcurrentMap to store the mapping between servletPath and loaders. This relationship is clearly defined in oracle.adfinternal.view.resource.rich.RenderKitResourceLoader

• The method _register in the RenderKitResourceLoader() function is called, passing the corresponding regex + loader, then returns super.register (its parent function). This function adds the pattern and corresponding loader to the concurrentmap_loaders. Therefore, when the loader is initialized in the doGet() function and receives the input request parameter, the servletPath from the request URL is taken and passed to _loader.get() to retrieve the corresponding servlet.

• The vulnerability author believes that among the classes containing the overridden findResource() method, oracle.adfinternal.view.resource.rich.RemoteApplicationResourceLoader is the class that poses a deserialization risk. Let's analyze it to find the reason.

Analysis of the findResource() function in RemoteApplicationResourceLoader.class

This function returns a method containing a custom protocol RAStreamHandler(). RAStreamHandler creates a URLConnection object with the value new RAURLConnection.

The RAURLConnection function calls the _getPathBean function.

The _getPathBean function contains a bean object created by calling the getInstanceFromString() function, which processes the input string to extract the corresponding keys (filter).

The input bean string is converted via the SerializationUtils class from URL-encoded form into a URLEncoderPathBean object. If everything is still fine, the subsequent input continues to be passed to the fromURLEncodeString() function.

If the input string encounters an error, it throws an exception. Exceptions mainly come from the library used in the payload, due to version mismatch or incorrect path to the Lambda file.

In the fromURLEncodedString() function, a fromString function is returned with the url parameter, and its code is as follows:

In the fromString function, data is readObject() and returned. It can be seen that the input is not filtered at all. It passes through many functions and finally gets deserialized in fromString(). This is the sink for exploitation. With the sink found, now we need to find the source.

3. Finding the source: as analyzed above, to find the source, we need to determine the input request URL. We see that to call the findResource() function, we must be able to route to the RemoteApplicationResourceLoader class. In the RenderKitResourceLoader class, it is clearly defined:```bash this._register("/./remote/(.)", new RemoteApplicationResourceLoader());