CVE-2008-3257
published 2008-07-22CVE-2008-3257: Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers…
PriorityP274critical10CVSS 2.0
AVNACLAuNCCICAC
EXPLOIT
EPSS
83.59%
99.7th percentile
Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea | weblogic_server | — | — |
| bea_systems | weblogic_server | — | — |
| oracle | weblogic_server | <= 10.3 | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
"C" x 97 . pack("L", 0x10013930) x 3 . pack("L", 0x10013930) . pack("L", 0x10013931) . pack("L", 0x77EA411E)- →Detect exploitation attempts by inspecting HTTP POST requests where the HTTP version string (after the URI) is abnormally long (e.g., 4000+ bytes), particularly targeting .jsp paths such as '/.jsp' or '/index.jsp'. ↗
- →Fingerprinting probe: attacker sends a POST request with a randomly-valued Transfer-Encoding header and a chunked body to the target JSP URI; a 200 response containing 'Weblogic Bridge Message' indicates a vulnerable mod_wl connector. Monitor for this pattern. ↗
- →Alert on HTTP responses containing the string 'Weblogic Bridge Message' in the body, as this is the banner returned by a vulnerable mod_wl connector and is actively used by exploit tooling for version fingerprinting. ↗
- →The exploit payload uses a 4102-byte offset before the return address overwrite. Detect HTTP POST requests where the request line (method + URI + version field) exceeds 4000 bytes as an anomaly indicator for this CVE. ↗
- →The bad characters for the payload are null byte, CR, LF, and '?'. Shellcode in exploit traffic will avoid these bytes; use this to tune payload-detection signatures. ↗
- →Build dates in the 'Weblogic Bridge Message' response body on or before 'Jul 28 2008' indicate a vulnerable connector version. Parse this date from error responses to identify unpatched systems. ↗
- ·The Windows exploit (DoS path) in the PoC is acknowledged as broken/incomplete by the author; only the Windows RCE path and the Metasploit module are functional. ↗
- ·The Metasploit module targets Windows systems without DEP only; exploitation on DEP-enabled or non-Windows systems is not supported by these exploit implementations. ↗
- ·Return addresses (ROP gadgets) in the Metasploit module are hardcoded per specific mod_wl_20.so build versions (SP4/SP5/SP6); they will not work against other builds or OS locales. ↗
- ·The original PoC return address 0x10013930 targets Windows Server 2003 Enterprise Edition SP2 RC1 English only; it will not work on other OS versions or locales. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Oracle Weblogic Apache Connector - POST Buffer Overflow (Metasploit)
exploitdb·2012-05-19
CVE-2008-3257 Oracle Weblogic Apache Connector - POST Buffer Overflow (Metasploit)
Oracle Weblogic Apache Connector - POST Buffer Overflow (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 [ /Apache/ ] }
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Oracle Weblogic Apache Connector POST Request Buffer Overflow',
'Description' => %q{
This module exploits a stack based buffer overflow in the BEA
Weblogic Apache plugin.
The connector fails to properly handle specially crafted HTTP POST
requests, resulting a buffer overflow due to the insecure usage
of sprintf. Currently, this
Exploit-DB
Bea Weblogic Apache Connector - Code Execution / Denial of Service
exploitdb·2008-07-17
CVE-2008-3257 Bea Weblogic Apache Connector - Code Execution / Denial of Service
Bea Weblogic Apache Connector - Code Execution / Denial of Service
---
#// Bea Weblogic -- Apache Connector Remote Exploit +-1day
#// Should stack break latest Windows Server 2003
#// BIG THANKS TO
#// "dong-hun you"(Xpl017Elz) in INetCop - for his paper
#// "Title: Advanced exploitation in exec-shield (Fedora Core case study)"
#// His technique works fine against Windows 2003 latest version.
#//
#// The code is broken, since I am chilling out for now
#// SKIDDI BULLETPROOF
#// You may fixup the DoS Code, Windows Code Works on English OSs
#// KingCope -- July/2008
use IO::Socket;
use strict;
$|=1;
my $apacheport = 80; #// Touch
###
my $wrongusage = 0;
my $dodoshost = 0;
###############################################################################
### Target List Entries |Operating S
Metasploit
Oracle Weblogic Apache Connector POST Request Buffer Overflow
metasploit
Oracle Weblogic Apache Connector POST Request Buffer Overflow
Oracle Weblogic Apache Connector POST Request Buffer Overflow
This module exploits a stack based buffer overflow in the BEA Weblogic Apache plugin. The connector fails to properly handle specially crafted HTTP POST requests, resulting a buffer overflow due to the insecure usage of sprintf. Currently, this module works over Windows systems without DEP, and has been tested with Windows 2000 / XP. In addition, the Weblogic Apache plugin version is fingerprinted with a POST request containing a specially crafted Transfer-Encoding header.
No writeups or analysis indexed.
http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.htmlhttp://secunia.com/advisories/31146http://www.attrition.org/pipermail/vim/2008-July/002035.htmlhttp://www.attrition.org/pipermail/vim/2008-July/002036.htmlhttp://www.kb.cert.org/vuls/id/716387http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.htmlhttp://www.securityfocus.com/bid/30273http://www.securitytracker.com/id?1020520http://www.vupen.com/english/advisories/2008/2145/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/43885https://support.bea.com/application_content/product_portlets/securityadvisories/2793.htmlhttps://www.exploit-db.com/exploits/6089http://blogs.oracle.com/security/2008/07/security_alert_for_cve-2008-3257_released.htmlhttp://secunia.com/advisories/31146http://www.attrition.org/pipermail/vim/2008-July/002035.htmlhttp://www.attrition.org/pipermail/vim/2008-July/002036.htmlhttp://www.kb.cert.org/vuls/id/716387http://www.oracle.com/technology/deploy/security/alerts/alert_cve2008-3257.htmlhttp://www.securityfocus.com/bid/30273http://www.securitytracker.com/id?1020520http://www.vupen.com/english/advisories/2008/2145/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/43885https://support.bea.com/application_content/product_portlets/securityadvisories/2793.htmlhttps://www.exploit-db.com/exploits/6089
2008-07-22
Published