Researchers flag new Oracle WebLogic zero-day RCE flaw
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-2725 | Unauthenticated Injection in Oracle WebLogic Web Services Enables RCE CVE-2019-2725 is an easily exploitable injection flaw (CWE-74) in the Web Services subcomponent of Oracle WebLogic Server within Oracle Fusion Middleware, publicly documented as affecting WebLogic 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.3. It is triggered when an unauthenticated remote attacker sends attacker-controlled XML over HTTP to the WebLogic Web Services async response endpoint (the /_async/AsyncResponseService servlet), which processes the input unsafely. Successful attacks give the attacker takeover of the affected WebLogic server (remote code execution); in the 2019 exploitation wave this was used to install cryptocurrency miners and deploy ransomware. Any organization running affected Oracle WebLogic Server versions is exposed, with the greatest risk where the async/Web Services endpoints are reachable, especially on internet-facing servers. Exploitation is confirmed in the wild: CISA added the CVE to its KEV catalog on 2022-01-10 with ransomware use known and requires applying vendor updates, the EPSS probability of exploitation is 100% (100th percentile), and no public PoC is catalogued. Do: Apply Oracle's updates per vendor instructions: this CVE was fixed by Oracle's April 2019 out-of-band WebLogic patch and is covered by subsequent Critical Patch Updates, so bring affected WebLogic 10.3.6.0/12.1.3.0/12.2.1.x servers to a patched level (CISA KEV requires this action). Until patched, restrict or remove the async response service deployments (wls9_async_response.war / wls_wsee_async_response.war, exposing the /_async/AsyncResponseService endpoint) and keep WebLogic ports off the internet. Also review logs for unsolicited POSTs to /_async/AsyncResponseService and for signs of dropped miners or ransomware payloads. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of internet-exposed WebLogic servers (~30,000+ reported in 2019 internet scans), plus a much larger internal install base |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 12.2.1.3 | iety of popular databases. Its last stable release – 12cR2 (12.2.1.3) – dates back to August 2017. According to the researchers, |
Full article419 words · extracted from helpnetsecurity.com · click to collapse
Attackers looking to compromise Oracle WebLogic servers for their own needs have a new zero-day RCE flaw at their disposal.
“Oracle WebLogic wls9_async and wls-wsat components trigger deserialization remote command execution vulnerability. This vulnerability affects all Weblogic versions (including the latest version) that have the wls9_async_response.war and wls-wsat.war components enabled,” KnownSec 404 researchers warn.
The flaw has been reported to Oracle, but is yet to receive a CVE number. It can be currently tracked under the following identifier: CNVD-C-2019-48814.
About Oracle WebLogic
Oracle WebLogic is a Java EE application server that is part of Oracle’s Fusion Middleware portfolio and supports a variety of popular databases. Its last stable release – 12cR2 (12.2.1.3) – dates back to August 2017.
According to the researchers, tens of thousands WebLogic servers can be found across the world, predominantly deployed in the US and China but also in Iran, Germany, India, and so on. How many of these are actually vulnerable is yet unknown.
The danger
Oracle WebLogic Servers are often targeted by attackers, who are usually intent on compromising them and using their copious resources for covert crypto-mining.
Although, as they are often deployed in enterprise settings and connected to other enterprise systems, they could also be exploited to steal sensitive data (PII, IP, etc.).
Oracle recently released a Critical Patch Update and the next one is scheduled for July. If the company decides against publishing an out-of-band security update for this flaw, the researchers advise server administrators to keep their machines safe from exploitation by either:
- Finding and deleting wls9_async_response.war, wls-wsat.war and restarting the Weblogic service, or by
- Preventing access to the /_async/* and /wls-wsat/* URL paths via access policy control.
It is expected that attackers will waste no time to start prowling for vulnerable installations and exploting them.
SANS ISC handler Rob VandenBrink pointed out that the root cause of the vulnerability seems to be that the affected WAR components ingest and process all serialized data and have a blacklist of “bad” content.
“What this means to me is that we’re likely to see a number of similar vulnerabilities / attacks crop up over the next while, until Oracle changes this approach,” he added.
UPDATE (3 p.m. PT):
Oracle has released an out-of-band security fix for Oracle Fusion Middleware which addresses this WebLogic vulnerability. The flaw has also been assigned a CVE number: CVE-2019-2725.
The vulnerability is under active exploitation, so if you’re running an Internet-facing WebLogic server, you might want to patch it sooner rather than later.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/04/25/oracle-weblogic-zero-day-rce/