Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2021-2302 — Proof-of-concept exploit for CVE-2021-2302 targeting Oracle WebLogic Server with a deserialization-based RCE gadget chain using MVEL expression execution. | Kitploit
Tools/GitHubGitHub/quynhle7821/cve-2021-2302
Vulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingPayload DevelopmentArchived
GitHubquynhle7821/cve-2021-2302

CVE-2021-2302

Proof-of-concept exploit for CVE-2021-2302 targeting Oracle WebLogic Server with a deserialization-based RCE gadget chain using MVEL expression execution.

View Repository
9224 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2021-2302

Author: quynhle

Gadget chain

root@kitploit:~
javax.management.BadAttributeValueExpException.readObject()
  oracle.security.jps.az.internal.common.principals.toString()
    oracle.security.jps.az.internal.common.principals.getResolvedPrincipal()
         . . . con.newInstance() . . .
      com.tangosol.coherence.mvel2.sh.ShellSession()
      com.tangosol.coherence.mvel2.sh.ShellSession.exec()
              . . . MVEL expression . . .
  --->   RCE

Lab Environment

  • Orace Weblogic Server: 12.1.2.3
  • Oracle Business Intelligence: 12.1.2.4
  • Oracle Database 19c

PoC

gif

Download Tool