Vulnerabilities > CVE-2019-2725 - Injection vulnerability in Oracle products
Summary
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Server Side Include (SSI) Injection An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
- Cross Site Scripting through Log Files An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
- Command Line Execution through SQL Injection An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
- Subverting Environment Variable Values The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
Exploit-Db
id EDB-ID:46814 last seen 2019-05-08 modified 2019-05-08 published 2019-05-08 reporter Exploit-DB source https://www.exploit-db.com/download/46814 title Oracle Weblogic Server - 'AsyncResponseService' Deserialization Remote Code Execution (Metasploit) file exploits/windows/webapps/46780.py id EDB-ID:46780 last seen 2019-04-30 modified 2019-04-30 platform windows port published 2019-04-30 reporter Exploit-DB source https://www.exploit-db.com/download/46780 title Oracle Weblogic 10.3.6.0.0 / 12.1.3.0.0 - Remote Code Execution type webapps
Metasploit
description | An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a malicious SOAP request to the interface WLS AsyncResponseService to execute code on the vulnerable host. |
id | MSF:EXPLOIT/MULTI/MISC/WEBLOGIC_DESERIALIZE_ASYNCRESPONSESERVICE |
last seen | 2020-06-14 |
modified | 2019-05-20 |
published | 2019-04-26 |
references | |
reporter | Rapid7 |
source | https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/misc/weblogic_deserialize_asyncresponseservice.rb |
title | Oracle Weblogic Server Deserialization RCE - AsyncResponseService |
Nessus
NASL family Misc. NASL id ORACLE_WEBLOGIC_SERVER_CPU_JUL_2019.NASL description The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability allows a remote unauthenticated attacker with network access to compromise and takeover the StorageTek Tape Analytics SW Tool. (CVE-2019-2725) (CVE-2019-2729) - An unspecified vulnerability allows a remote unauthenticated attacker with network access to compromise and takeover the Tape Virtual Storage Manager GUI. (CVE-2019-2725) - An unspecified vulnerability in the WLS Core Component allows an authenticated low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server, resulting in unauthorized update, insert or delete access to Oracle WebLogic Server accessible data. (CVE-2019-2824) (CVE-2019-2827) - An unspecified vulnerability in the jQuery Component allows an authenticated low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server, resulting in unauthorized update, insert or delete access to Oracle WebLogic Server accessible data. Successful attacks require human interaction from actions from another Weblogic user. (CVE-2016-71030) - An unspecified vulnerability in the Application Container - JavaEE Component of Oracle WebLogic Server allows an unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. A successful attack of this vulnerability could result in takeover of Oracle WebLogic Server. (CVE-2019-2856) - An unspecified vulnerability in the Sample apps (Spring Framework) Component of Oracle WebLogic Server allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. A successful attack of this vulnerability could result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. (CVE-2018-15756) last seen 2020-06-01 modified 2020-06-02 plugin id 126915 published 2019-07-22 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126915 title Oracle WebLogic Server Multiple Vulnerabilities (Jul 2019 CPU) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(126915); script_version("1.10"); script_cvs_date("Date: 2019/11/20"); script_cve_id( "CVE-2016-7103", "CVE-2018-15756", "CVE-2019-2725", "CVE-2019-2729", "CVE-2019-2824", "CVE-2019-2827", "CVE-2019-2856" ); script_bugtraq_id(107944); script_name(english:"Oracle WebLogic Server Multiple Vulnerabilities (Jul 2019 CPU)"); script_summary(english:"Checks the version of Oracle WebLogic to ensure the July 2019 CPU is applied."); script_set_attribute(attribute:"synopsis", value: "An application server installed on the remote host is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability allows a remote unauthenticated attacker with network access to compromise and takeover the StorageTek Tape Analytics SW Tool. (CVE-2019-2725) (CVE-2019-2729) - An unspecified vulnerability allows a remote unauthenticated attacker with network access to compromise and takeover the Tape Virtual Storage Manager GUI. (CVE-2019-2725) - An unspecified vulnerability in the WLS Core Component allows an authenticated low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server, resulting in unauthorized update, insert or delete access to Oracle WebLogic Server accessible data. (CVE-2019-2824) (CVE-2019-2827) - An unspecified vulnerability in the jQuery Component allows an authenticated low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server, resulting in unauthorized update, insert or delete access to Oracle WebLogic Server accessible data. Successful attacks require human interaction from actions from another Weblogic user. (CVE-2016-71030) - An unspecified vulnerability in the Application Container - JavaEE Component of Oracle WebLogic Server allows an unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. A successful attack of this vulnerability could result in takeover of Oracle WebLogic Server. (CVE-2019-2856) - An unspecified vulnerability in the Sample apps (Spring Framework) Component of Oracle WebLogic Server allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. A successful attack of this vulnerability could result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. (CVE-2018-15756)"); # https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9aa2b901"); # https://www.oracle.com/technetwork/security-advisory/cpujul2019verbose-5072838.html#FMW script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?09b101ce"); script_set_attribute(attribute:"solution", value: "Apply the appropriate patch according to the July 2019 Oracle Critical Patch Update advisory. Refer to Oracle for any additional patch instructions or mitigation options."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-2729"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Oracle Weblogic Server Deserialization RCE - AsyncResponseService'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"agent", value:"all"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/07/16"); script_set_attribute(attribute:"patch_publication_date", value:"2019/07/16"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/07/22"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:fusion_middleware"); script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:weblogic_server"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Misc."); script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("oracle_weblogic_server_installed.nbin", "os_fingerprint.nasl"); script_require_keys("installed_sw/Oracle WebLogic Server"); exit(0); } include('audit.inc'); include('global_settings.inc'); include('misc_func.inc'); include('install_func.inc'); include('obj.inc'); include('spad_log_func.inc'); app_name = "Oracle WebLogic Server"; install = get_single_install(app_name:app_name, exit_if_unknown_ver:TRUE); ohome = install["Oracle Home"]; subdir = install["path"]; version = install["version"]; fix = NULL; fix_ver = NULL; spad_log(message:"checking version [" + version + "]"); # individual security patches if (version =~ "^12\.2\.1\.3($|[^0-9])") { fix_ver = "12.2.1.3.190522"; fix = make_list("29814665"); } else if (version =~ "^12\.1\.3\.") { fix_ver = "12.1.3.0.190716"; fix = make_list("29633448"); } else if (version =~ "^10\.3\.6\.") { fix_ver = "10.3.6.0.190716"; fix = make_list("MXLE"); # patchid is obtained from the readme and 10.3.6.x assets are different } else audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, subdir); spad_log(message:"checking fix [" + obj_rep(fix) + "]"); PATCHED=FALSE; # Iterate over the list of patches and check the install for the patchID foreach id (fix) { spad_log(message:"Checking fix id: [" + id +"]"); if (install[id]) { PATCHED=TRUE; break; } } VULN=FALSE; if (ver_compare(ver:version, fix:fix_ver, strict:FALSE) == -1) VULN=TRUE; if (PATCHED || !VULN) audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, subdir); os = get_kb_item_or_exit("Host/OS"); if ('windows' >< tolower(os)) { port = get_kb_item("SMB/transport"); if (!port) port = 445; } else port = 0; report = '\n Oracle Home : ' + ohome + '\n Install path : ' + subdir + '\n Version : ' + version + '\n Fixes : ' + join(sep:", ", fix); security_report_v4(extra:report, severity:SECURITY_HOLE, port:port);
NASL family Misc. NASL id ORACLE_WEBLOGIC_CVE-2019-2725.NASL description The version of Oracle WebLogic Server installed on the remote host is affected by a remote code execution vulnerability in the WLS9-async component due to unsafe deserialization of XML encoded Java objects. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java code in the context of the WebLogic server. last seen 2020-06-01 modified 2020-06-02 plugin id 124337 published 2019-04-26 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124337 title Oracle WebLogic Server wls9_async_response / wls-wsat Remote Code Execution code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(124337); script_version("1.10"); script_cvs_date("Date: 2019/10/30 13:24:46"); script_cve_id("CVE-2019-2725"); script_bugtraq_id(108074); script_xref(name:"IAVA", value:"2019-A-0128"); script_name(english:"Oracle WebLogic Server wls9_async_response / wls-wsat Remote Code Execution"); script_summary(english:"Checks for the patch."); script_set_attribute(attribute:"synopsis", value: "An application server installed on the remote host is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Oracle WebLogic Server installed on the remote host is affected by a remote code execution vulnerability in the WLS9-async component due to unsafe deserialization of XML encoded Java objects. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java code in the context of the WebLogic server. "); # https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html#AppendixFMW script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?95b9a80b"); script_set_attribute(attribute:"solution", value: "Apply the appropriate patch according to the Oracle Security Alert Advisory. Refer to Oracle for any additional patch instructions or mitigation options."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-2725"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Oracle Weblogic Server Deserialization RCE - AsyncResponseService'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2019/04/24"); script_set_attribute(attribute:"patch_publication_date", value:"2019/04/26"); script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/26"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:fusion_middleware"); script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:weblogic_server"); script_set_attribute(attribute:"in_the_news", value:"true"); script_set_attribute(attribute:"agent", value:"unix"); script_set_attribute(attribute:"agent", value:"windows"); script_set_attribute(attribute:"stig_severity", value:"I"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Misc."); script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("oracle_weblogic_server_installed.nbin", "os_fingerprint.nasl"); script_require_keys("installed_sw/Oracle WebLogic Server"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("install_func.inc"); include("obj.inc"); include("spad_log_func.inc"); app_name = "Oracle WebLogic Server"; install = get_single_install(app_name:app_name, exit_if_unknown_ver:TRUE); ohome = install["Oracle Home"]; subdir = install["path"]; version = install["version"]; fix_sets = []; extra = NULL; spad_log(message:"checking version [" + version + "]"); if (version =~ "^12\.1\.3\." && ver_compare(ver:version, fix:"12.1.3.0.190716", strict:FALSE) < 0) { fix_sets = [ { 'fix_cpu' : '28710923', 'fix_adv' : '29694149'}, { 'fix_cpu' : '29204657', 'fix_adv' : '29694149'}, { 'fix_cpu' : '28710923', 'fix_adv' : '29792735'}, { 'fix_cpu' : '29204657', 'fix_adv' : '29792736'}, { 'fix_cpu' : '29633448', 'fix_adv' : '29633448'} # this little check-the-same-thing-2x code-hack allows us check for a supersede patch, thanks oracle! ]; extra = '28710923 and 29694149 or 29204657 and 29694149 or 29633448\n'; } else if (version =~ "^10\.3\.6\." && ver_compare(ver:version, fix:"10.3.6.0.190716", strict:FALSE) < 0) { fix_sets = [ { 'fix_cpu' : '7HKN', 'fix_adv' : 'ICDZ'}, { 'fix_cpu' : 'U5I2', 'fix_adv' : 'IL49'}, { 'fix_cpu' : '7HKN', 'fix_adv' : '5H68'}, { 'fix_cpu' : 'U5I2', 'fix_adv' : '6JJ4'}, { 'fix_cpu' : 'MXLE', 'fix_adv' : 'MXLE'} # this little check-the-same-thing-2x code-hack allows us check for a supersede patch, thanks oracle! ]; extra = '7HKN and ICDZ or U5I2 and IL49 or MXLE\n'; } else audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, subdir); foreach fix (fix_sets) { if( !isnull(install[fix['fix_cpu']]) && !isnull(install[fix['fix_adv']]) ) audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, subdir); } os = get_kb_item_or_exit('Host/OS'); if ('windows' >< tolower(os)) { port = get_kb_item('SMB/transport'); if (!port) port = 445; } else port = 0; report = '\n Oracle Home : ' + ohome + '\n Install path : ' + subdir + '\n Version : ' + version + '\n Fix : ' + extra; security_report_v4(extra:report, severity:SECURITY_HOLE, port:port);
Packetstorm
data source | https://packetstormsecurity.com/files/download/152756/weblogic_deserialize_asyncresponseservice.rb.txt |
id | PACKETSTORM:152756 |
last seen | 2019-05-08 |
published | 2019-05-07 |
reporter | Andres Rodriguez |
source | https://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html |
title | Oracle Weblogic Server Deserialization Remote Code Execution |
Saint
bid | 108074 |
description | Oracle WebLogic Server deserialization remote code execution |
id | web_dev_weblogicdeserial |
title | weblogic_deserialization_rce |
type | remote |
The Hacker News
id THN:C3BFE86E2BE38F28D9CEB17AD2C50EBD last seen 2019-05-01 modified 2019-05-01 published 2019-05-01 reporter The Hacker News source https://thehackernews.com/2019/05/ransomware-oracle-weblogic.html title Hackers Found Exploiting Oracle WebLogic RCE Flaw to Spread Ransomware id THN:515CD17353FD69BC2811599574546F0A last seen 2019-06-19 modified 2019-06-19 published 2019-06-19 reporter The Hacker News source https://thehackernews.com/2019/06/oracle-weblogic-vulnerability.html title New Critical Oracle WebLogic Flaw Under Active Attack — Patch Now
Related news
References
- http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html
- https://support.f5.com/csp/article/K90059138
- https://www.exploit-db.com/exploits/46780/
- http://www.securityfocus.com/bid/108074
- http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
- https://www.oracle.com/security-alerts/cpujan2020.html
- https://www.oracle.com/security-alerts/alert-cve-2019-2725.html#AppendixFMW