Another Remote Code Execution Flaw in WebLogic exploited in the wild
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-2725 | Unauthenticated Injection in Oracle WebLogic Web Services Enables RCE CVE-2019-2725 is an easily exploitable injection flaw (CWE-74) in the Web Services subcomponent of Oracle WebLogic Server within Oracle Fusion Middleware, publicly documented as affecting WebLogic 10.3.6.0, 12.1.3.0, 12.2.1.1 and 12.2.1.3. It is triggered when an unauthenticated remote attacker sends attacker-controlled XML over HTTP to the WebLogic Web Services async response endpoint (the /_async/AsyncResponseService servlet), which processes the input unsafely. Successful attacks give the attacker takeover of the affected WebLogic server (remote code execution); in the 2019 exploitation wave this was used to install cryptocurrency miners and deploy ransomware. Any organization running affected Oracle WebLogic Server versions is exposed, with the greatest risk where the async/Web Services endpoints are reachable, especially on internet-facing servers. Exploitation is confirmed in the wild: CISA added the CVE to its KEV catalog on 2022-01-10 with ransomware use known and requires applying vendor updates, the EPSS probability of exploitation is 100% (100th percentile), and no public PoC is catalogued. Do: Apply Oracle's updates per vendor instructions: this CVE was fixed by Oracle's April 2019 out-of-band WebLogic patch and is covered by subsequent Critical Patch Updates, so bring affected WebLogic 10.3.6.0/12.1.3.0/12.2.1.x servers to a patched level (CISA KEV requires this action). Until patched, restrict or remove the async response service deployments (wls9_async_response.war / wls_wsee_async_response.war, exposing the /_async/AsyncResponseService endpoint) and keep WebLogic ports off the internet. Also review logs for unsolicited POSTs to /_async/AsyncResponseService and for signs of dropped miners or ransomware payloads. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of internet-exposed WebLogic servers (~30,000+ reported in 2019 internet scans), plus a much larger internal install base | |
| CVE-2019-2729 | Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). NVD description · AI analysis pending | 9.8 | 89% | PoC |
| — |
Full article394 words · extracted from securityaffairs.com · click to collapse
Oracle released emergency patches for another critical remote code execution vulnerability affecting WebLogic Server.
On Tuesday, Oracle released emergency patches for another critical remote code execution vulnerability affecting the WebLogic Server.
The vulnerability, tracked as CVE-2019-2729, affects WebLogic versions 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. The vulnerability is a remotely exploitable deserialization vulnerability via XMLDecoder in Oracle WebLogic Server Web Services, it received a CVSS score of 9.8.
A remote attacker could exploit the CVE-2019-2729 flaw without authentication. The issue was independently reported to Oracle by many security researchers.
“This Security Alert addresses CVE-2019-2729, a deserialization vulnerability via XMLDecoder in Oracle WebLogic Server Web Services. This remote code execution vulnerability is remotely exploitable without authentication, i.e., may be exploited over a network without the need for a username and password.” reads the security advisory published by Oracle.
“Due to the severity of this vulnerability, Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as possible.”
Oracle urges its users to apply the necessary patches and also the latest Critical Patch Update (CPU).
John Heimann, VP of Security Program Management at Oracle, pointed out that the CVE-2019-2729 is different from the recently discovered CVE-2019-2725 that was exploited in cryptojacking campaigns and in hacking campaigns spreading the Sodinokibi ransomware.
“Please note that while the issue addressed by this alert is a deserialization vulnerability, like that addressed in Security Alert CVE-2019-2725, it is a distinct vulnerability.” wrote Heimann.
“Due to the severity of this vulnerability, Oracle recommends that this Security Alert be applied as soon as possible.”
According to the experts at Knownsec 404 Team who also reported the flaw, the CVE-2019-2729 is actually the result of an uncomplete patch for CVE-2019-2725. Knownsec 404 Team confirmed that threat actors are already exploiting the CVE-2019-2729 in the wild.
“Then today, a new oracle webLogic deserialization RCE 0day vulnerability was found and is being actively used in the wild.We analyzed and reproduced the 0day vulnerability, which is based on and bypasses the patch for CVE-2019–2725.” reads a post published by Knownsec 404 Team.
Knownsec 404 Team provided the following temporary solutions:
- Scenario-1: Find and delete wls9_async_response.war, wls-wsat.war and restart the Weblogic service.
- Scenario-2: Controls URL access for the /_async/* and /wls-wsat/* paths by access policy control.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – CVE-2019-2729, hacking)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/87327/hacking/weblogic-rce-cve-2019-2729.html