Vulnerabilities > CVE-2019-2725 - Injection vulnerability in Oracle products

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
oracle
CWE-74
nessus
exploit available
metasploit

Summary

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0 and 12.1.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Vulnerable Configurations

Part Description Count
Application
Oracle
218

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Server Side Include (SSI) Injection
    An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.

Exploit-Db

  • idEDB-ID:46814
    last seen2019-05-08
    modified2019-05-08
    published2019-05-08
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/46814
    titleOracle Weblogic Server - 'AsyncResponseService' Deserialization Remote Code Execution (Metasploit)
  • fileexploits/windows/webapps/46780.py
    idEDB-ID:46780
    last seen2019-04-30
    modified2019-04-30
    platformwindows
    port
    published2019-04-30
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/46780
    titleOracle Weblogic 10.3.6.0.0 / 12.1.3.0.0 - Remote Code Execution
    typewebapps

Metasploit

descriptionAn unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a malicious SOAP request to the interface WLS AsyncResponseService to execute code on the vulnerable host.
idMSF:EXPLOIT/MULTI/MISC/WEBLOGIC_DESERIALIZE_ASYNCRESPONSESERVICE
last seen2020-06-14
modified2019-05-20
published2019-04-26
references
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/misc/weblogic_deserialize_asyncresponseservice.rb
titleOracle Weblogic Server Deserialization RCE - AsyncResponseService

Nessus

  • NASL familyMisc.
    NASL idORACLE_WEBLOGIC_SERVER_CPU_JUL_2019.NASL
    descriptionThe version of Oracle WebLogic Server installed on the remote host is affected by multiple vulnerabilities: - An unspecified vulnerability allows a remote unauthenticated attacker with network access to compromise and takeover the StorageTek Tape Analytics SW Tool. (CVE-2019-2725) (CVE-2019-2729) - An unspecified vulnerability allows a remote unauthenticated attacker with network access to compromise and takeover the Tape Virtual Storage Manager GUI. (CVE-2019-2725) - An unspecified vulnerability in the WLS Core Component allows an authenticated low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server, resulting in unauthorized update, insert or delete access to Oracle WebLogic Server accessible data. (CVE-2019-2824) (CVE-2019-2827) - An unspecified vulnerability in the jQuery Component allows an authenticated low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server, resulting in unauthorized update, insert or delete access to Oracle WebLogic Server accessible data. Successful attacks require human interaction from actions from another Weblogic user. (CVE-2016-71030) - An unspecified vulnerability in the Application Container - JavaEE Component of Oracle WebLogic Server allows an unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. A successful attack of this vulnerability could result in takeover of Oracle WebLogic Server. (CVE-2019-2856) - An unspecified vulnerability in the Sample apps (Spring Framework) Component of Oracle WebLogic Server allows an unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. A successful attack of this vulnerability could result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server. (CVE-2018-15756)
    last seen2020-06-01
    modified2020-06-02
    plugin id126915
    published2019-07-22
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126915
    titleOracle WebLogic Server Multiple Vulnerabilities (Jul 2019 CPU)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(126915);
      script_version("1.10");
      script_cvs_date("Date: 2019/11/20");
    
      script_cve_id(
        "CVE-2016-7103",
        "CVE-2018-15756",
        "CVE-2019-2725",
        "CVE-2019-2729",
        "CVE-2019-2824",
        "CVE-2019-2827",
        "CVE-2019-2856"
      );
      script_bugtraq_id(107944);
    
      script_name(english:"Oracle WebLogic Server Multiple Vulnerabilities (Jul 2019 CPU)");
      script_summary(english:"Checks the version of Oracle WebLogic to ensure the July 2019 CPU is applied.");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application server installed on the remote host is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Oracle WebLogic Server installed on the remote host is
    affected by multiple vulnerabilities:
    
      - An unspecified vulnerability allows a remote unauthenticated 
        attacker with network access to compromise and takeover the 
        StorageTek Tape Analytics SW Tool. (CVE-2019-2725) (CVE-2019-2729)
    
      - An unspecified vulnerability allows a remote unauthenticated 
        attacker with network access to compromise and takeover the 
        Tape Virtual Storage Manager GUI. (CVE-2019-2725)
    
      - An unspecified vulnerability in the WLS Core Component allows an 
        authenticated low privileged attacker with network 
        access via HTTP to compromise Oracle WebLogic Server, resulting 
        in unauthorized update, insert or delete access to Oracle 
        WebLogic Server accessible data. (CVE-2019-2824) (CVE-2019-2827)
    
      - An unspecified vulnerability in the jQuery Component allows an 
        authenticated low privileged attacker with network 
        access via HTTP to compromise Oracle WebLogic Server, resulting 
        in unauthorized update, insert or delete access to Oracle 
        WebLogic Server accessible data. Successful attacks require
        human interaction from actions from another Weblogic user.
        (CVE-2016-71030)
    
      - An unspecified vulnerability in the Application Container - JavaEE
        Component of Oracle WebLogic Server allows an unauthenticated
        attacker with network access via T3 to compromise Oracle WebLogic
        Server. A successful attack of this vulnerability could result in
        takeover of Oracle WebLogic Server. (CVE-2019-2856)
        
      - An unspecified vulnerability in the Sample apps (Spring Framework)
        Component of Oracle WebLogic Server allows an unauthenticated
        attacker with network access via HTTP to compromise Oracle WebLogic
        Server. A successful attack of this vulnerability could result in
        unauthorized ability to cause a hang or frequently repeatable crash
        (complete DOS) of Oracle WebLogic Server. (CVE-2018-15756)");
      # https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9aa2b901");
      # https://www.oracle.com/technetwork/security-advisory/cpujul2019verbose-5072838.html#FMW
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?09b101ce");
      script_set_attribute(attribute:"solution", value:
    "Apply the appropriate patch according to the July 2019 Oracle
    Critical Patch Update advisory.
    
    Refer to Oracle for any additional patch instructions or
    mitigation options.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-2729");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Oracle Weblogic Server Deserialization RCE - AsyncResponseService');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
      script_set_attribute(attribute:"agent", value:"all");
    
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/07/16");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/07/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/07/22");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:fusion_middleware");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:weblogic_server");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Misc.");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("oracle_weblogic_server_installed.nbin", "os_fingerprint.nasl");
      script_require_keys("installed_sw/Oracle WebLogic Server");
    
      exit(0);
    }
    
    include('audit.inc');
    include('global_settings.inc');
    include('misc_func.inc');
    include('install_func.inc');
    include('obj.inc');
    include('spad_log_func.inc');
    
    app_name = "Oracle WebLogic Server";
    
    install = get_single_install(app_name:app_name, exit_if_unknown_ver:TRUE);
    ohome = install["Oracle Home"];
    subdir = install["path"];
    version = install["version"];
    
    fix = NULL;
    fix_ver = NULL;
    
    spad_log(message:"checking version [" + version + "]");
    # individual security patches
    if (version =~ "^12\.2\.1\.3($|[^0-9])")
    {
      fix_ver = "12.2.1.3.190522";
      fix = make_list("29814665");
    }
    else if (version =~ "^12\.1\.3\.")
    {
      fix_ver = "12.1.3.0.190716";
      fix = make_list("29633448");
    }
    else if (version =~ "^10\.3\.6\.")
    {
      fix_ver = "10.3.6.0.190716";
      fix = make_list("MXLE"); # patchid is obtained from the readme and 10.3.6.x assets are different
    }
    else
      audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, subdir);
    
    spad_log(message:"checking fix [" + obj_rep(fix) + "]");
    PATCHED=FALSE;
    
    # Iterate over the list of patches and check the install for the patchID
    foreach id (fix)
    {
     spad_log(message:"Checking fix id: [" + id +"]");
     if (install[id])
     {
       PATCHED=TRUE;
       break;
     }
    }
    
    VULN=FALSE;
    if (ver_compare(ver:version, fix:fix_ver, strict:FALSE) == -1)
      VULN=TRUE;
    
    if (PATCHED || !VULN)
      audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, subdir);
    
    os = get_kb_item_or_exit("Host/OS");
    if ('windows' >< tolower(os))
    {
      port = get_kb_item("SMB/transport");
      if (!port) port = 445;
    }
    else port = 0;
    
    report =
      '\n  Oracle Home    : ' + ohome +
      '\n  Install path   : ' + subdir +
      '\n  Version        : ' + version +
      '\n  Fixes          : ' + join(sep:", ", fix);
    
    security_report_v4(extra:report, severity:SECURITY_HOLE, port:port);
    
  • NASL familyMisc.
    NASL idORACLE_WEBLOGIC_CVE-2019-2725.NASL
    descriptionThe version of Oracle WebLogic Server installed on the remote host is affected by a remote code execution vulnerability in the WLS9-async component due to unsafe deserialization of XML encoded Java objects. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java code in the context of the WebLogic server.
    last seen2020-06-01
    modified2020-06-02
    plugin id124337
    published2019-04-26
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124337
    titleOracle WebLogic Server wls9_async_response / wls-wsat Remote Code Execution
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(124337);
      script_version("1.10");
      script_cvs_date("Date: 2019/10/30 13:24:46");
    
      script_cve_id("CVE-2019-2725");
      script_bugtraq_id(108074);
      script_xref(name:"IAVA", value:"2019-A-0128");
    
      script_name(english:"Oracle WebLogic Server wls9_async_response / wls-wsat Remote Code Execution");
      script_summary(english:"Checks for the patch.");
    
      script_set_attribute(attribute:"synopsis", value:
    "An application server installed on the remote host is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Oracle WebLogic Server installed on the remote host
    is affected by a remote code execution vulnerability in the WLS9-async component
    due to unsafe deserialization of XML encoded Java objects. An unauthenticated, 
    remote attacker can exploit this, via a crafted Java object, to execute 
    arbitrary Java code in the context of the WebLogic server.
    ");
      # https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html#AppendixFMW
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?95b9a80b");
      script_set_attribute(attribute:"solution", value:
    "Apply the appropriate patch according to the Oracle Security Alert
    Advisory.
    
    Refer to Oracle for any additional patch instructions or
    mitigation options.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-2725");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Oracle Weblogic Server Deserialization RCE - AsyncResponseService');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/04/24");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/04/26");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/26");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:fusion_middleware");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:weblogic_server");
      script_set_attribute(attribute:"in_the_news", value:"true");
      script_set_attribute(attribute:"agent", value:"unix");
      script_set_attribute(attribute:"agent", value:"windows");
      script_set_attribute(attribute:"stig_severity", value:"I");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Misc.");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("oracle_weblogic_server_installed.nbin", "os_fingerprint.nasl");
      script_require_keys("installed_sw/Oracle WebLogic Server");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("install_func.inc");
    include("obj.inc");
    include("spad_log_func.inc");
    
    app_name = "Oracle WebLogic Server";
    
    install = get_single_install(app_name:app_name, exit_if_unknown_ver:TRUE);
    ohome = install["Oracle Home"];
    subdir = install["path"];
    version = install["version"];
    
    fix_sets = [];
    extra = NULL;
    
    spad_log(message:"checking version [" + version + "]");
    
    if (version =~ "^12\.1\.3\." && ver_compare(ver:version, fix:"12.1.3.0.190716", strict:FALSE) < 0)
    {
      fix_sets = [
        { 'fix_cpu' : '28710923', 'fix_adv' : '29694149'},
        { 'fix_cpu' : '29204657', 'fix_adv' : '29694149'},
        { 'fix_cpu' : '28710923', 'fix_adv' : '29792735'},
        { 'fix_cpu' : '29204657', 'fix_adv' : '29792736'},
        { 'fix_cpu' : '29633448', 'fix_adv' : '29633448'} # this little check-the-same-thing-2x code-hack allows us check for a supersede patch, thanks oracle!
      ];
      extra = '28710923 and 29694149 or 29204657 and 29694149 or 29633448\n';
    }
    else if (version =~ "^10\.3\.6\."  && ver_compare(ver:version, fix:"10.3.6.0.190716", strict:FALSE) < 0)
    {
      fix_sets = [
        { 'fix_cpu' : '7HKN', 'fix_adv' : 'ICDZ'},
        { 'fix_cpu' : 'U5I2', 'fix_adv' : 'IL49'},
        { 'fix_cpu' : '7HKN', 'fix_adv' : '5H68'},
        { 'fix_cpu' : 'U5I2', 'fix_adv' : '6JJ4'},
        { 'fix_cpu' : 'MXLE', 'fix_adv' : 'MXLE'} # this little check-the-same-thing-2x code-hack allows us check for a supersede patch, thanks oracle!
      ];
      extra = '7HKN and ICDZ or U5I2 and IL49 or MXLE\n';
    }
    else
      audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, subdir);
    
    foreach fix (fix_sets)
    {
      if( !isnull(install[fix['fix_cpu']]) && !isnull(install[fix['fix_adv']]) )
        audit(AUDIT_INST_PATH_NOT_VULN, app_name, version, subdir);
    }
    
    os = get_kb_item_or_exit('Host/OS');
    if ('windows' >< tolower(os))
    {
      port = get_kb_item('SMB/transport');
      if (!port) port = 445;
    }
    else port = 0;
    
    report =
      '\n  Oracle Home    : ' + ohome +
      '\n  Install path   : ' + subdir +
      '\n  Version        : ' + version + 
      '\n  Fix            : ' + extra;
    
    security_report_v4(extra:report, severity:SECURITY_HOLE, port:port);
    

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/152756/weblogic_deserialize_asyncresponseservice.rb.txt
idPACKETSTORM:152756
last seen2019-05-08
published2019-05-07
reporterAndres Rodriguez
sourcehttps://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html
titleOracle Weblogic Server Deserialization Remote Code Execution

Saint

bid108074
descriptionOracle WebLogic Server deserialization remote code execution
idweb_dev_weblogicdeserial
titleweblogic_deserialization_rce
typeremote

The Hacker News