nuclei-templates/cves/2019/CVE-2019-2725.yaml

id: CVE-2019-2725

info:
  name: Oracle WebLogic Server - Remote Command Execution
  author: dwisiswant0
  severity: critical
  description: |
    The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0.
  reference:
    - https://paper.seebug.org/910/
    - https://www.exploit-db.com/exploits/46780/
    - https://www.oracle.com/security-alerts/cpujan2020.html
    - https://nvd.nist.gov/vuln/detail/CVE-2019-2725
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-2725
    cwe-id: CWE-74
  tags: cve,cve2019,oracle,weblogic,rce

requests:
  - method: POST
    path:
      - "{{BaseURL}}/_async/AsyncResponseService"
    headers:
      Content-Type: application/soap;  charset="utf-8"
    body: >-
      <?xml version="1.0" encoding="UTF-8" ?>
      <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
      xmlns:ads="http://www.w3.org/2005/08/addressing">
        <soapenv:Header></soapenv:Header>
        <soapenv:Body></soapenv:Body>
      </soapenv:Envelope>
    matchers-condition: and
    matchers:
      - type: word
        words:
          - "soapenv:Envelope"
        part: body
      - type: word
        words:
          - "X-Powered-By: Servlet"
        part: header
      - type: status
        status:
          - 200

# Enhanced by mp on 2022/05/03
misc changes 2021-01-02 04:59:06 +00:00			`id: CVE-2019-2725`
:fire: Add CVE-2019-2725 2020-08-16 16:33:49 +00:00
			`info:`
Dashboard Content Enhancements (#4338) Dashboard Content Enhancements 2022-05-09 16:12:52 +00:00			`name: Oracle WebLogic Server - Remote Command Execution`
:fire: Add CVE-2019-2725 2020-08-16 16:33:49 +00:00			`author: dwisiswant0`
			`severity: critical`
Description and referenes 2021-03-30 12:10:17 +00:00			`description: \|`
Dashboard Content Enhancements (#4338) Dashboard Content Enhancements 2022-05-09 16:12:52 +00:00			`The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services) allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Versions that are affected are 10.3.6.0.0 and 12.1.3.0.0.`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-18 11:37:49 +00:00			`reference:`
Description and referenes 2021-03-30 12:10:17 +00:00			`- https://paper.seebug.org/910/`
			`- https://www.exploit-db.com/exploits/46780/`
			`- https://www.oracle.com/security-alerts/cpujan2020.html`
Dashboard Content Enhancements (#4338) Dashboard Content Enhancements 2022-05-09 16:12:52 +00:00			`- https://nvd.nist.gov/vuln/detail/CVE-2019-2725`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`classification:`
additional reference to cves templates (#4395) * additional reference to cves templates * Update CVE-2006-1681.yaml * Update CVE-2009-3318.yaml * Update CVE-2009-4223.yaml * Update CVE-2010-0942.yaml * Update CVE-2010-0944.yaml * Update CVE-2010-0972.yaml * Update CVE-2010-1304.yaml * Update CVE-2010-1308.yaml * Update CVE-2010-1313.yaml * Update CVE-2010-1461.yaml * Update CVE-2010-1470.yaml * Update CVE-2010-1471.yaml * Update CVE-2010-1472.yaml * Update CVE-2010-1474.yaml * removed duplicate references * misc fix Co-authored-by: Prince Chaddha <prince@projectdiscovery.io> Co-authored-by: Prince Chaddha <cyberbossprince@gmail.com> 2022-05-17 09:18:12 +00:00			`cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`cvss-score: 9.8`
Added cve annotations + severity adjustments 2021-09-10 11:26:40 +00:00			`cve-id: CVE-2019-2725`
			`cwe-id: CWE-74`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`tags: cve,cve2019,oracle,weblogic,rce`
:fire: Add CVE-2019-2725 2020-08-16 16:33:49 +00:00
			`requests:`
			`- method: POST`
			`path:`
			`- "{{BaseURL}}/_async/AsyncResponseService"`
Missing headers 2021-03-11 17:51:40 +00:00			`headers:`
			`Content-Type: application/soap; charset="utf-8"`
:fire: Add CVE-2019-2725 2020-08-16 16:33:49 +00:00			`body: >-`
			`<?xml version="1.0" encoding="UTF-8" ?>`
			`<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"`
			`xmlns:ads="http://www.w3.org/2005/08/addressing">`
			`<soapenv:Header></soapenv:Header>`
			`<soapenv:Body></soapenv:Body>`
			`</soapenv:Envelope>`
			`matchers-condition: and`
			`matchers:`
			`- type: word`
			`words:`
			`- "soapenv:Envelope"`
			`part: body`
			`- type: word`
			`words:`
			`- "X-Powered-By: Servlet"`
			`part: header`
			`- type: status`
			`status:`
Dashboard Content Enhancements (#4338) Dashboard Content Enhancements 2022-05-09 16:12:52 +00:00			`- 200`

			`# Enhanced by mp on 2022/05/03`