Another Oracle WebLogic Server RCE under active exploitation
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-2725 | Unauthenticated Injection in Oracle WebLogic Web Services Enables RCE CVE-2019-2725 is an easily exploitable injection flaw (CWE-74) in the Web Services subcomponent of Oracle WebLogic Server within Oracle Fusion Middleware, publicly documented as affecting WebLogic 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.3. It is triggered when an unauthenticated remote attacker sends attacker-controlled XML over HTTP to the WebLogic Web Services async response endpoint (the /_async/AsyncResponseService servlet), which processes the input unsafely. Successful attacks give the attacker takeover of the affected WebLogic server (remote code execution); in the 2019 exploitation wave this was used to install cryptocurrency miners and deploy ransomware. Any organization running affected Oracle WebLogic Server versions is exposed, with the greatest risk where the async/Web Services endpoints are reachable, especially on internet-facing servers. Exploitation is confirmed in the wild: CISA added the CVE to its KEV catalog on 2022-01-10 with ransomware use known and requires applying vendor updates, the EPSS probability of exploitation is 100% (100th percentile), and no public PoC is catalogued. Do: Apply Oracle's updates per vendor instructions: this CVE was fixed by Oracle's April 2019 out-of-band WebLogic patch and is covered by subsequent Critical Patch Updates, so bring affected WebLogic 10.3.6.0/12.1.3.0/12.2.1.x servers to a patched level (CISA KEV requires this action). Until patched, restrict or remove the async response service deployments (wls9_async_response.war / wls_wsee_async_response.war, exposing the /_async/AsyncResponseService endpoint) and keep WebLogic ports off the internet. Also review logs for unsolicited POSTs to /_async/AsyncResponseService and for signs of dropped miners or ransomware payloads. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of internet-exposed WebLogic servers (~30,000+ reported in 2019 internet scans), plus a much larger internal install base | |
| CVE-2019-2729 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). NVD description · AI analysis pending | 9.8 | 89% | PoC |
| — |
Full article321 words · extracted from helpnetsecurity.com · click to collapse
Oracle has released an out-of-band fix for CVE-2019-2729, a critical deserialization vulnerability in a number of versions of Oracle WebLogic Server, and is urging customers to apply the security update as soon as possible.
Speed is of the essence as, according to KnownSec 404 researchers, the vulnerability is already being exploited in the wild.
About the vulnerability (CVE-2019-2729)
“This remote code execution vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password,” Oracle noted.
If this sounds familiar, it’s because the a similar (but distinct) vulnerability (CVE-2019-2725) was revealed and fixed in April and has been actively exploited by attackers to deliver ransomware and cryptominers.
KnownSec 404 researchers say that CVE-2019-2729 is, in fact, based on and bypasses the patch for CVE-2019–2725.
Oracle fixes a bypass for a bypass fix of a bypass that was bypssed during fixing a bug that was used to bypass the bypass fix of a serialization issue in weblogic. https://t.co/dFAzfuQNyd
— Hamid K (@hkashfi) June 16, 2019
Before Oracle released the patch, KnownSec 404 advised users to mitigate the risk by:
- Finding and deleting wls9_async_response.war, wls-wsat.war and restarting the Weblogic service, or by
- Preventing access to the /_async/* and /wls-wsat/* URL paths via access policy control.
This advice is still valid for those who can’t quickly upgrade their WebLogic installation.
The only good news is that, unlike CVE-2019-2725, CVE-2019-2729 does not affect all WebLogic versions, just 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0.
Oracle WebLogic Server is a preferred target
Oracle WebLogic is a Java EE application server that is part of Oracle’s Fusion Middleware portfolio and supports a variety of popular databases.
It’s often used by organizations and connected to other enterprise systems, so it can serve as a stepping stone for attackers looking to steal sensitive data. Still, it is mostly targeted for its abundant resources, which attackers want to use to covertly mine cryptocurrency.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2019/06/19/cve-2019-2729/