Skip to main content

​
Overview

Oracle WebLogic Server is a Java EE application server. scan4all includes POCs for 11 different Weblogic vulnerabilities spanning from 2014 to 2021, covering SSRF, deserialization, and console RCE attacks.
Weblogic vulnerabilities are frequently targeted in the wild. Ensure your Weblogic servers are patched and properly configured.

​
Supported Vulnerabilities

​
CVE-2014-4210 - SSRF Vulnerability

CVE-2014-4210

TypeSSRF (Server-Side Request Forgery)
Affected Versions10.0.2 - 10.3.6
Discovery Date2014
CVSS Score5.8 (Medium)
Description: WebLogic SSRF vulnerability allows attackers to scan internal network ports and services through the UDDI explorer. Detection Method: 
// Checks for vulnerable UDDI explorer endpoint
GET /uddiexplorer/SearchPublicRegistries.jsp
Vulnerable Path: /uddiexplorer/SearchPublicRegistries.jsp

​
CVE-2017-3506 - WLS-WSAT Component RCE

CVE-2017-3506

TypeRemote Code Execution
Affected Versions10.3.6.0, 12.1.3.0, 12.2.1.0-2
Discovery DateApril 2017
CVSS Score7.4 (High)
Description: Unauthenticated remote code execution via WLS-WSAT component. Allows attackers to take control of the server through XML deserialization. Component: wls-wsat (Web Services Atomic Transactions)

​
CVE-2017-10271 - WLS-WSAT Component RCE

CVE-2017-10271

TypeRemote Code Execution
Affected Versions10.3.6.0, 12.1.3.0, 12.2.1.1-2
Discovery DateOctober 2017
CVSS Score9.8 (Critical)
Description: Another critical RCE in the WLS-WSAT component. This is one of the most exploited Weblogic vulnerabilities. Impact: Complete server compromise without authentication

​
CVE-2018-2894 - Unrestricted File Upload

CVE-2018-2894

TypeArbitrary File Upload
Affected Versions12.1.3.0, 12.2.1.2-3
Discovery DateJuly 2018
CVSS Score9.8 (Critical)
Description: Deserialization vulnerability leading to arbitrary file upload. Attackers can upload malicious files through the web service test page. Vulnerable Components:
  • Web Service Test Page
  • Configuration management

​
CVE-2019-2725 - Async Deserialization RCE

CVE-2019-2725

TypeDeserialization RCE
Affected Versions10.3.6.0, 12.1.3.0
Discovery DateApril 2019
CVSS Score9.8 (Critical)
Description: WLS9-Async deserialization vulnerability allowing unauthenticated remote code execution. Component: _async descriptor in wls9_async_response

​
CVE-2019-2729 - Async Deserialization RCE

CVE-2019-2729

TypeDeserialization RCE
Affected Versions10.3.6.0, 12.1.3.0
Discovery DateJune 2019
CVSS Score9.8 (Critical)
Description: Similar to CVE-2019-2725 but bypasses the initial patch. Another deserialization vulnerability in wls9_async.
CVE-2019-2729 was a patch bypass for CVE-2019-2725, showing the complexity of fixing deserialization issues.

​
CVE-2020-2883 - IIOP/T3 Deserialization RCE

CVE-2020-2883

TypeDeserialization RCE
Affected Versions10.3.6.0, 12.1.3.0, 12.2.1.3-4
Discovery DateApril 2020
CVSS Score9.8 (Critical)
Description: Deserialization vulnerability in IIOP and T3 protocols allowing remote code execution. Protocols Affected:
  • IIOP (Internet Inter-ORB Protocol)
  • T3 (WebLogic proprietary protocol)

​
CVE-2020-14882 - Console Authentication Bypass

CVE-2020-14882

TypeAuthentication Bypass / RCE
Affected Versions10.3.6.0, 12.1.3.0, 12.2.1.3-4, 14.1.1.0
Discovery DateOctober 2020
CVSS Score9.8 (Critical)
Description: Unauthenticated remote code execution through the administration console. Allows attackers to bypass authentication and execute arbitrary code. Detection Method: 
GET /console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=a
Vulnerable Endpoint: WebLogic Administration Console
This vulnerability was actively exploited in the wild shortly after disclosure. Immediate patching is critical.

​
CVE-2020-14883 - Console RCE

CVE-2020-14883

TypeRemote Code Execution
Affected Versions10.3.6.0, 12.1.3.0, 12.2.1.3-4, 14.1.1.0
Discovery DateOctober 2020
CVSS Score7.2 (High)
Description: Remote code execution via the console. Often chained with CVE-2020-14882 for full compromise. Common Attack Chain: CVE-2020-14882 → CVE-2020-14883

​
CVE-2021-2109 - Unauthorized JNDI Access

CVE-2021-2109

TypeUnauthorized Access
Affected Versions10.3.6.0, 12.1.3.0, 12.2.1.3-4, 14.1.1.0
Discovery DateJanuary 2021
CVSS Score5.9 (Medium)
Description: Unauthorized JNDI lookup allowing attackers to access restricted resources. Component: JNDI (Java Naming and Directory Interface)

​
CNVD-C-2019-48814

CNVD-C-2019-48814

TypeOracle WebLogic Vulnerability
Affected VersionsVarious
Discovery Date2019
SourceChina National Vulnerability Database
Description: Chinese National Vulnerability Database entry for Oracle WebLogic. Location: pocs_go/oracle/weblogic/CNVD-C-2019-48814.go

​
Usage

​
Scanning for Weblogic Vulnerabilities

# Scan a single Weblogic server
scan4all -h http://weblogic.example.com:7001

# Scan multiple Weblogic servers
scan4all -l weblogic_servers.txt

# Focus on specific CVE
scan4all -h http://weblogic.example.com:7001 -poc CVE-2020-14882

​
Common Weblogic Ports

  • 7001 - Default HTTP port
  • 7002 - Default HTTPS port
  • 7003-7009 - Additional managed server ports

​
Mitigation

1

Apply Oracle Security Patches

Install the latest Critical Patch Updates (CPU) from Oracle.
2

Disable Unnecessary Components

Disable WLS-WSAT and other unused components.
3

Implement Network Segmentation

Restrict access to Weblogic console and administrative interfaces.
4

Enable Security Features

Configure authentication, authorization, and audit logging.
5

Monitor for Exploitation

Watch for suspicious requests to known vulnerable endpoints.

​
Detection Indicators

​
Network Indicators

  • Requests to /uddiexplorer/
  • Requests to /_async/ or /wls-wsat/
  • Encoded console paths: %252e%252e%252f
  • Unusual XML payloads with Java class names

​
File System Indicators

  • Unexpected JSP files in web directories
  • Modified configuration files
  • New user accounts

​
Source Code Location

pocs_go/weblogic/
├── CVE_2014_4210.go
├── CVE_2017_3506.go
├── CVE_2017_10271.go
├── CVE_2018_2894.go
├── CVE_2019_2725.go
├── CVE_2019_2729.go
├── CVE_2020_2883.go
├── CVE_2020_14882.go
├── CVE_2020_14883.go
└── CVE_2021_2109.go

pocs_go/oracle/weblogic/
└── CNVD-C-2019-48814.go

​
References

All POCs are implemented for detection purposes. Responsible use and proper authorization are required.

Build docs developers (and LLMs) love

Get started for freeTalk to us