CISA adds Oracle WebLogic Server flaw to its Known Exploited Vulnerabilities catalog

CVE-2017-3506 is an unauthenticated operating system command injection flaw (CWE-78) in the Web Services subcomponent of Oracle WebLogic Server. A remote attacker with network access over HTTP can trigger it, though the flaw is rated difficult to exploit (high attack complexity). Successful exploitation allows the attacker to create, delete, or modify critical data and gain unauthorized access to critical data — potentially all data accessible to WebLogic Server — without authentication, with no availability impact. Organizations running affected versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1, or 12.2.1.2 are exposed, especially where the HTTP interface is internet-reachable. The flaw is under active attack: CISA added it to the Known Exploited Vulnerabilities catalog on 2024-06-03, EPSS is at 96.3%, and the 8220 gang is exploiting it to deliver infostealers and cryptocurrency miners.

Do: Apply the Oracle Critical Patch Update from April 2017 or later (or upgrade WebLogic Server to a patched, supported release), consistent with CISA's KEV required action to apply vendor mitigations or discontinue use. Until patched, restrict network access to the Web Services HTTP interface. Hunt affected servers for 8220 gang activity — unexpected child processes, cryptomining loads, and infostealer artifacts — since exploitation requires no authentication.