[Research] WebLogic Vulnerability Series—SSRF Vulnerability

[Research] WebLogic Vulnerability Series—SSRF Vulnerability

• • 1. Environment
  • 2. Principles
  • 3. Affected Versions
  • 4. Exploitation Process
  • Injecting HTTP Headers and Using Redis to Obtain a Reverse Shell

1. Environment

Environment
https://github.com/vulhub/vulhub/blob/master/README.zh-cn.md
Setting up this environment is quick and convenient. Refer to the instructions for details; it is very simple.

2. Principles

WebLogic contains an SSRF vulnerability that can be exploited to send arbitrary HTTP requests and subsequently attack vulnerable internal network components such as Redis and FastCGI.
Visit http://ip:7001/uddiexplorer/ to view uddiexplorer without logging in.

3. Affected Versions

4. Exploitation Process

Start the environment.

The SSRF vulnerability exists in http://your-ip:7001/uddiexplorer/SearchPublicRegistries.jsp. Access it directly.

Payload:
?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.0.0.1:7001

Append it to the URL.http://10.77.0.130:7001/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.0.0.1:7001`

The key point is the operator parameter.

• An accessible port will return an error. When port 7001 is accessed, it returns a 404 status code.
• Change it to a nonexistent port, and it will return could not connect over HTTP to server

Exists
![Insert image description here](/images/20190815151338337.png Does not exist
![Insert image description here](/images/20190815151345115.png Internal network port probing

Based on the different status information returned, we can determine whether an internal IP address exists and whether the corresponding port is open. One thing to note is that the target’s internal network range must be known. Blindly scanning network ranges will consume a great deal of time.

During real-world vulnerability research, it was discovered that this location may disclose the internal network range.

A case found in practice

Injecting HTTP Headers and Using Redis to Obtain a Reverse Shell

I will cover this separately in the next article; it is feasible.