CVE-2016-0638

published 2016-04-21

CVE-2016-0638: Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to…

Priority P1 90 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV Initial access

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

hash 6517e4c8f19243298949711b48ae2eb0b6c764235534ab29603288bc5fa2e158↗

hash 9da32d35a28d2f8481a4e3263e2f0bb3836b6aebeacf53cd37f2fe24a769ff52↗

hash 8c1115d866f9f645788f3689dff9a5bacfbee1df51058b4161819c750cf7c4a1↗

hash 14083cf438605d38a206be33542c7a4d48fb67c8ca0cfc165fa5f279a6d55361↗

hash b96a81b71d69a9bcb5a3f9f4edccb4a3c7373159d8eda874e053b23d361107f0↗

hash bbe5577639233b5a83c4caebf807c553430cab230f9a15ec519670dd8be6a924↗

hash a698441f817a9a72908a0d93a34133469f33a7b34972af3e351bdccae0737d99↗

process weblogic.jms.common.StreamMessageImpl↗

yara↗

rule generic_jsp
{
meta:
 description = "Generic JSP"
 family = "JSP Backdoor"
 filetype = "JSP"
 hash = "6517e4c8f19243298949711b48ae2eb0b6c764235534ab29603288bc5fa2e158"

strings:
 $exec = /Runtime.getRuntime\(\).exec\(request.getParameter\(\"[a-zA-Z0-9]+\"\)\);/ ascii

condition:
 all of them
}

• → CVE-2016-0638 bypasses the CVE-2015-4852 blacklist by routing deserialization through weblogic.jms.common.StreamMessageImpl's readExternal(), which uses a PayloadStream (an ObjectInputStream subclass) not covered by the blacklist. ↗
• → The bypass exploits classes whose readObject()/readExternal() methods accept an InputStream and wrap it in a new ObjectInputStream, circumventing the ServerChannelInputStream/MsgAbbrevInputStream blacklist check. ↗
• → Use YARA filesystem scanning (e.g., via Nessus file system scanner) to hunt for JSP web shells dropped after WebLogic exploitation; the generic_jsp rule targets Runtime.getRuntime().exec(request.getParameter(...)) patterns. ↗

• · JSP web shells dropped via this exploit have very low AV detection rates (2/54 observed), making AV an unreliable sole detection control; filesystem YARA scanning is recommended. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.