CVE-2017-3248
published 2017-01-27CVE-2017-3248: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are…
PriorityP187critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
97.30%
99.9th percentile
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| puppet | puppet | >= 0 < 3.4.3-1ubuntu1.2 | 3.4.3-1ubuntu1.2 |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
74332031322e322e310a41533a3235350a484c3a31390a4d533a31303030303030300a0a
bytes↗
000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec9...
bytes↗
056508000000010000001b0000005d010100737201787073720278700000000000000000757203787000000000787400087765626c6f67696375720478700000000c9c979a9a8c9a9bcfcf9b939a7400087765626c6f67696306fe010000
bytes↗
aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200025b42acf317f8060854e002000078707702000078fe010000
bytes↗
fe010000aced0005737200257765626c6f6769632e726a766d2e496d6d757461626c6553657276696365436f6e74657874ddcba8706386f0ba0c0000787200297765626c6f6769632e726d692e70726f76696465722e426173696353657276696365436f6e74657874e4632236c5d4a71e0c0000787077020600737200267765626c6f6769632e726d692e696e7465726e616c2e4d6574686f6444657363726970746f7212485a828af7f67b0c000078707734002e61757468656e746963617465284c7765626c6f6769632e73656375726974792e61636c2e55736572496e666f3b290000001b7878fe00ff
- →Detect CVE-2017-3248 exploitation by monitoring T3 protocol traffic to WebLogic ports for serialized Java objects containing the magic bytes 'aced0005' followed by WebLogic-specific class descriptors such as 'weblogic.rjvm.ClassTableEntry' (hex: 7765626c6f6769632e726a766d2e436c6173735461626c65456e747279). ↗
- →Detect the T3 handshake initiation payload on the wire: the first packet sent by the exploit begins with the ASCII string 't3 12.2.1' (hex: 74332031322e322e31) followed by AS/HL/MS headers. Alert on this pattern on WebLogic T3 listener ports. ↗
- →Detect outbound JRMP callback connections from WebLogic servers to attacker-controlled hosts. After exploitation, the server initiates a TCP connection to the attacker's JRMPListener port (default 3412) to fetch the second-stage payload. ↗
- →Vulnerability check: if the server response to the third exploit packet does NOT contain the string 'cannot be cast to weblogic', the target is vulnerable to CVE-2017-3248. ↗
- →The exploit sends a serialized sun.rmi.server.UnicastRef object over the T3 protocol. Network detection should look for T3 traffic containing the UnicastRef class descriptor bytes targeting WebLogic server ports. ↗
- ·The exploit requires a two-stage attack: the first stage sends a JRMPClient payload to the WebLogic server, which then calls back to the attacker's JRMPListener. Both the outbound T3 connection and the inbound JRMP callback must be possible for exploitation to succeed. ↗
- ·SSL-wrapped T3 connections are also supported by the exploit, meaning TLS inspection may be required to detect the malicious payloads in encrypted WebLogic T3S traffic. ↗
- ·The exploit depends on ysoserial's JRMPClient and JRMPListener gadgets. The payload type for the second-stage RCE defaults to CommonsCollections5, but any ysoserial-supported gadget chain can be substituted. ↗
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv6.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j377-ff8h-jf66: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components)
ghsa_unreviewed·2022-05-14
CVE-2017-3248 [CRITICAL] GHSA-j377-ff8h-jf66: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
OSV
puppet vulnerabilities
osv·2017-06-05·CVSS 6.2
CVE-2014-3248 puppet vulnerabilities
puppet vulnerabilities
Dennis Rowe discovered that Puppet incorrectly handled the search path. A
local attacker could use this issue to possibly execute arbitrary code.
(CVE-2014-3248)
It was discovered that Puppet incorrectly handled YAML deserialization. A
remote attacker could possibly use this issue to execute arbitrary code on
the master. This update is incompatible with agents older than 3.2.2.
(CVE-2017-2295)
No detection rules found.
Exploit-DB
Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution
exploitdb·2018-07-07·CVSS 9.8
CVE-2017-3248 [CRITICAL] Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution
Oracle WebLogic 12.1.2.0 - RMI Registry UnicastRef Object Java Deserialization Remote Code Execution
---
#!/usr/bin/python
# -*- coding: utf-8 -*-
from argparse import RawTextHelpFormatter
import socket, argparse, subprocess, ssl, os.path
HELP_MESSAGE = '''
Developped by bobsecq: [email protected] ([email protected])
This script is the first public exploit/POC for:
- Exploiting CVE-2017-3248 (Oracle WebLogic RMI Registry UnicastRef Object Java Deserialization Remote Code Execution)
- Checking if a weblogic server is vulnerable
This script needs the last version of Ysoserial (https://github.com/frohoff/ysoserial)
Version affected (according to Oracle):
- 10.3.6.0
- 12.1.3.0
- 12.2.1.0
- 12.2.1.1
'''
'''
Tested on 12.1.2.0
For technical information, see:
- https://www.t
Metasploit
Oracle Weblogic Server Deserialization RCE - RMI UnicastRef
metasploit
Oracle Weblogic Server Deserialization RCE - RMI UnicastRef
Oracle Weblogic Server Deserialization RCE - RMI UnicastRef
An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a serialized object (sun.rmi.server.UnicastRef) to the interface to execute code on vulnerable hosts.
http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.htmlhttp://www.securityfocus.com/bid/95465http://www.securitytracker.com/id/1037632https://www.exploit-db.com/exploits/44998/https://www.tenable.com/security/research/tra-2017-07http://packetstormsecurity.com/files/152357/Oracle-Weblogic-Server-Deserialization-RMI-UnicastRef-Remote-Code-Execution.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujan2017-2881727.htmlhttp://www.securityfocus.com/bid/95465http://www.securitytracker.com/id/1037632https://www.exploit-db.com/exploits/44998/https://www.tenable.com/security/research/tra-2017-07https://www.vicarius.io/vsociety/posts/cve-2017-3248-detect-centos-weblogic-rcehttps://www.vicarius.io/vsociety/posts/cve-2017-3248-mitigate-centos-weblogic-rce
2017-01-27
Published