Easily exploitable RCE in Oracle WebLogic Server under attack (CVE-2020-14882)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-14750 | Unauthenticated RCE in Oracle WebLogic Server Console (CVE-2020-14750) CVE-2020-14750 is a critical vulnerability in the Console component of Oracle WebLogic Server (Oracle Fusion Middleware), functioning as a bypass of the earlier fix for the widely exploited CVE-2020-14882. An unauthenticated attacker with network access over HTTP can trigger it simply by sending crafted requests to the web administration console, with no credentials or user interaction required. Successful exploitation results in full takeover of the WebLogic Server, yielding high impact to confidentiality, integrity and availability (CVSS 3.1 score of 9.8). All supported WebLogic Server versions are affected — 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 — particularly deployments whose admin console is reachable from the internet. Exploitation is confirmed in the wild: the flaw is in CISA's KEV catalog (added 2021-11-03), carries a 99.3% EPSS, and multiple botnets have been observed exploiting it, with reports of access brokers selling compromised-server access to ransomware operators. Do: Apply Oracle's emergency/out-of-cycle patch for CVE-2020-14750 or any later Critical Patch Update on all affected WebLogic versions (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0), per vendor instructions. Until patched, restrict HTTP access to the WebLogic admin console to trusted networks and prioritize remediating internet-facing consoles. Hunt for signs of exploitation, since multiple botnets are actively scanning for and exploiting this flaw. | 9.8 | 99% | KEV |
| largetens of thousands of internet-exposed WebLogic servers (total installed base substantially larger) | |
| CVE-2020-14882 | Remote Code Execution in Oracle WebLogic Server CVE-2020-14882 is a remote code execution vulnerability in Oracle WebLogic Server; its relationship to CVE-2020-14750 (a WebLogic administration console flaw) indicates it is reachable over the network, likely without authentication. An attacker who can reach a vulnerable WebLogic instance can trigger the flaw and execute arbitrary code in the context of the server. Successful exploitation can yield full control of the affected host, enabling data theft, lateral movement, and potentially ransomware deployment (ransomware use is currently unknown). Any organization running Oracle WebLogic Server is affected; WebLogic is widely deployed as a Java application server in large enterprises and government networks, and instances are frequently exposed to the internet. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) and carries a maximum EPSS score of 100%, indicating confirmed in-the-wild exploitation. Do: Apply Oracle's WebLogic Server updates per vendor instructions immediately, as this is a required action under the CISA KEV listing. Inventory environments for WebLogic deployments (commonly listening on ports 7001/7002), prioritize patching internet-facing instances, and restrict or firewall access to the WebLogic administration console until patched. Review access logs for signs of exploitation, and treat unpatched, externally reachable WebLogic servers as high risk given the 100% EPSS score and confirmed in-the-wild exploitation. | 9.8 | 100% | KEV PoC ×3 |
| large≈50,000–100,000 internet-exposed WebLogic systems (public internet-wide scan counts around 2020); many more deployed internally in enterprise networks |
Full article637 words · extracted from helpnetsecurity.com · click to collapse
A critical and easily exploitable remote code execution vulnerability (CVE-2020-14882) in Oracle WebLogic Server is being targeted by attackers, SANS ISC has warned.
Oracle WebLogic is a Java EE application server that is part of Oracle’s Fusion Middleware portfolio and supports a variety of popular databases. These servers are often targeted by attackers, whether for cryptocurrency mining or as a way into other enterprise systems.
About the vulnerability (CVE-2020-14882)
CVE-2020-14882 may allow unauthenticated attackers with network access via HTTP to achieve total compromise and takeover of vulnerable Oracle WebLogic Servers.
The vulnerability affects the console component of Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0, and has been patched by Oracle last week.
Dr. Johannes Ullrich, Dean of Research at the SANS Technology Institute, said that SANS ISC’s honeypots are getting hit by exploit attempts originating from four IP addresses.
For now, the attackers are only probing to see whether the target systems are vulnerable, but that’s likely because the honeypots did not return the “correct” response.
“The exploit appears to be based on this blog post published in Vietnamese by ‘Jang’,” he added. (The researcher in question has previously flagged several flaws in Oracle’s offerings, though not this one.)
The exploit allows attackers to achieve RCE on a vulnerable Oracle WebLogic Server by sending a HTTP GET request.
A demonstration of the exploit in action is available here.
The PoC exploit was published yesterday, and it didn’t take long for attackers to take advantage of it. Admins are advised to patch vulnerable systems as soon as possible.
UPDATE (October 30, 2020, 3:00 a.m. PT):
“Rapid7 Labs has also seen evidence of opportunistic attackers seeking out vulnerable WebLogic instances,” Rapid7’s Chief Security Data Scientist Bob Rudis shared.
“Due to the widespread dissemination of the proof-of-concept code and evidence of active weaponization/exploitation, we expect to see continued attacks both on the public internet and within organizations where attackers have or will gain footholds.”
He urged admins to patch as quickly as possible, and recommended mitigations if immediate patching is impossible (“with the understanding that no mitigation is as effective as patching”).
These mitigations include temporarily:
- Removing the admin portal from the public internet
- reviewing application logs for HTTP requests that include the double-encoded path traversal %252E%252E%252F and the admin portal console.portal in the request URI
- Monitoring network traffic for suspicious HTTP requests (if possible)
- Monitoring for any suspicious processes created by the application
But, as Ullrich noted, due to how easy exploitation of the flaw is, if you find a vulnerable server in your network, assume it has been compromised and proceed to remedy the situation.
UPDATE (November 1, 2020, 3:00 a.m. PT):
Oracle has flagged today a new remote code execution vulnerability in Oracle WebLogic Server (CVE-2020-14750) that is related to the one patched two weeks ago (CVE-2020-14882).
“It is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password. Due to the severity of this vulnerability and the publication of exploit code on various sites, Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as possible,” the company noted.
As CVE-2020-14882 before it, CVE-2020-14750 affects Oracle WebLogic Server, versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0. Oracle advises customers to apply the updates provided through the security alert after they have applied the October 2020 Critical Patch Update.
Oracle has thanked twenty different researchers for reporting the vulnerability, which arose due to the flawed patch for CVE-2020-14882.
In Oracle's rush to fix it, they made a pretty simple error: attackers could avoid the new path traversal blacklist (and thus bypass the patch) by … wait for it… changing the case of a character in their request.https://t.co/fHWPkXCAlm
— Brett Winterford (@breditor) November 3, 2020
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2020/10/29/cve-2020-14882/