WebLogic Wls-wsat XMLDecoder

Vulnerability Description

mitre:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-3506

Early on, hackers leveraged the WebLogic WLS component vulnerability to launch large-scale remote attacks against enterprise servers, resulting in a large number of compromised servers. The number of attacked enterprises showed a clear upward trend, requiring heightened attention. Among them, CVE-2017-3506 is a remote code execution vulnerability in the WLS component of Oracle WebLogic, classified as a zero-day vulnerability with no publicly disclosed details. Many enterprises had not installed the patch in time. The official patch for this vulnerability was released in April 2017.

CVE-2017-3506 Patch Description:

public WorkContextXmlInputAdapter(InputStream is)
  {
    ByteArrayOutputStream baos = new ByteArrayOutputStream();
    try
    {
      int next = 0;
      next = is.read();
      while (next != -1)
      {
        baos.write(next);
        next = is.read();
      }
    }
    catch (Exception e)
    {
      throw new IllegalStateException("Failed to get data from input stream", e);
    }
    validate(new ByteArrayInputStream(baos.toByteArray()));
    this.xmlDecoder = new XMLDecoder(new ByteArrayInputStream(baos.toByteArray()));
  }
  
  private void validate(InputStream is)
  {
    WebLogicSAXParserFactory factory = new WebLogicSAXParserFactory();
    try
    {
      SAXParser parser = factory.newSAXParser();
      parser.parse(is, new DefaultHandler()
      {
        public void startElement(String uri, String localName, String qName, Attributes attributes)
          throws SAXException
        {
          if (qName.equalsIgnoreCase("object")) {
            throw new IllegalStateException("Invalid context type: object");
          }
        }
      });
    }
    catch (ParserConfigurationException e)
    {
      throw new IllegalStateException("Parser Exception", e);
    }
    catch (SAXException e)
    {
      throw new IllegalStateException("Parser Exception", e);
    }
    catch (IOException e)
    {
      throw new IllegalStateException("Parser Exception", e);
    }
  }