Web Server Oracle WebLogic Deserialization

Oracle WebLogic Server versions 10.3.6.0, 12.1.3.0, 12.2.1.2, and 12.2.1.3 contain a deserialization vulnerability that can be remotely exploited by unauthenticated attackers via the T3 protocol. Gadgets embedded within serialized WebLogic ClassTableEntry Objects are deserialized due to insufficient filtering.

Exploitation

Stages

1. The attacker sends a serialized Java object to the vulnerable server. When deserialized, the object will make a Remote Method Invocation (RMI) request to a server controlled by the attacker.
2. An attacker may send a serialized Java object that will execute a payload when deserialized, skipping stage 3 and 4.
3. The vulnerable server deserializes and executes the Java object in turn, sending an RMI request to invoke a method on a server controlled by the attacker.
4. The method executed on the attacker-controlled server returns a gadget as Java serialized block data that will execute the attacker’s payload when deserialized by the garbage collector.
5. The vulnerable server replies to the attacker with an error and stack trace showing a casting error as the result of successful deserialization and exploitation.

Prerequisites

The attacker must have remote access to the WLS administration console. Additionally, attackers do not require authentication.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Recommendations for Mitigation

Upgrade to a non-vulnerable version to mitigate this vulnerability.