cbcvebase.
CVE-2014-2424
published 2014-04-16

CVE-2014-2424: Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity…

PriorityP337medium4CVSS 2.0
AVNACLAuSCNIPAN
EXPLOIT
EPSS
48.35%
98.7th percentile
Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system.

Affected

5 ranges
VendorProductVersion rangeFixed in
jenkinsgit_plugin
jenkinsjenkins_core
jenkinsjenkins_lts
jenkinsjenkins_weekly
oraclefusion_middleware

Detection & IOCsextracted from sources · hover to see the quote

url/wlevs/visualizer/upload
port9002
pathWINDOWS/system32/wbem/mof/
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Oracle Event Processing FileUploadServlet Arbitrary File Upload"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/wlevs/visualizer/upload"; http.request_body; content:"filename"; pcre:"/^\s*?=\s*?[\x22\x27]?[^&]*?(?:%(?:25)?2e(?:%(?:(?:25)?2e(?:%(?:25)?5c|\/|\\)|2e(?:25)?%(?:25)?2f)|\.(?:%(?:25)?(?:2f|5c)|\/|\\))|\.(?:%(?:25)?2e(?:%(?:25)?(?:2f|5c)|\/|\\)|\.(?:%(?:25)?(?:2f|5c)|\/|\\)))/Ri"; reference:url,www.exploit-db.com/exploits/33989/; reference:cve,2014-2424; classtype:web-application-attack; sid:2018652; rev:4; metadata:created_at 2014_07_08, cve CVE_2014_2424, signature_severity Major, updated_at 2020_04_30;)
  • The vulnerable upload endpoint requires no authentication. Detect unauthenticated POST requests to /wlevs/visualizer/upload containing a multipart filename field with directory traversal sequences (e.g., ../, URL-encoded variants %2e%2e%2f, %2e%2e%5c).
  • Check for version fingerprinting requests to /ohw/help/state with query parameters navSetId=cepvi&navId=0 — this is the check method used by the Metasploit module to confirm a vulnerable target.
  • Default upload storage path on disk is C:\Oracle\Middleware\user_projects\domains\<domain>\defaultserver\upload\ — monitor for unexpected files or traversal artifacts relative to this directory.
  • The exploit uses a default traversal depth of 7 (../../../../../../..) to escape the upload directory. Alert on filename fields in multipart POST bodies to /wlevs/visualizer/upload containing 7 or more ../ sequences.
  • ·The WbemExec post-exploitation technique (dropping .mof + .exe) only works on Windows 2003 SP2 or older; the module does not support newer Windows targets.
  • ·Oracle Event Processing uses Jetty without JSP support by default, so JSP webshell uploads will not execute — the attack is constrained to filesystem-write techniques like WbemExec.
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.