CVE-2017-3506
published 2017-04-24CVE-2017-3506: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are…
PriorityP192high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2024-06-24
Exploited in the wild
EPSS
96.28%
99.9th percentile
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
commandPowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcACAAJABVAFMARQBSAE4AQQBNAEUAJAAgAFwAQQBwAHAARABhAHQAYQBcAFIAbwBhAG0AaQBuAGcAXABOAGEAbQBlAFwASQBzAFMAeQBuAGMAaAByAG8AbgBpAHoAZQBkAC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAIAAkAFUAUwBFAFIATgBBAE0ARQAkACAAXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE4AYQBtAGUAXABJAHMAUwB5AG4AYwBoAHIAbwBuAGkAegBlAGQALgBlAHgAZQA=↗
bytes↗
AES Key: 5D8D6871C3D59D855616603F686713AC48BF2351F6182EA282E1D84CBB15B94F | AES IV: CAAD009AC0881FE2A89F80CEEA6D1B6
- →Water Sigbin (8220 Gang) exploits CVE-2017-3506 to drop a PowerShell script that decodes and executes a Base64-encoded first-stage payload; monitor for PowerShell execution spawned from WebLogic server processes. ↗
- →The first-stage loader masquerades as the legitimate WireGuard VPN application (wireguard2-3.exe); alert on WireGuard-named executables dropped in temp directories and spawned from non-standard parent processes. ↗
- →The malware uses reflective DLL injection (Zxpus.dll loaded in-memory) and process injection into cvtres.exe for fileless execution; monitor for cvtres.exe spawned outside of build/compile contexts, especially from .NET framework paths. ↗
- →PureCrypter adds malware paths to Windows Defender exclusion list via a hidden scheduled task running an encoded PowerShell command; detect Add-MpPreference -ExclusionPath/-ExclusionProcess calls referencing AppData\Roaming\Name\ or AddInProcess.exe. ↗
- →The malware generates a victim unique ID from hardware info in the format [Processor ID]-[Disk Drive Signature]-[Disk Drive Serial Number]-[Baseboard Serial Number]-[GPU Model]-[Username] and encrypts it with MD5; network traffic to C2 containing this pattern can be used for detection. ↗
- →CVE-2017-3506 exploitation targets the /_async/* and /wls-wsat/* URL paths via malicious SOAP/XML requests; monitor HTTP traffic to these endpoints on WebLogic servers for XMLDecoder payloads. ↗
- →The group exploited Oracle WebLogic vulnerabilities using PowerShell scripts with hexadecimal encoding of URLs and fileless execution via .NET reflection techniques; hunt for hex-encoded URLs in PowerShell command lines targeting WebLogic hosts. ↗
- →Check Point IPS rule available for detection: 'Oracle WebLogic WLS Security Component Remote Code Execution (CVE-2017-10271)' covers related WebLogic WLS exploitation activity. ↗
- ·All payloads in the Water Sigbin campaign are protected with .NET Reactor, incorporating anti-debugging and code obfuscation, making static analysis and signature-based detection more difficult. ↗
- ·The PureCrypter loader version observed is V6.0.7D; version-specific detection rules should account for potential updates to this loader. ↗
- ·CVE-2017-3506 exploitation via the WorkContextXmlInputAdapter/XMLDecoder deserialization path was partially mitigated by a validate() blacklist function; subsequent CVEs (CVE-2019-2725, CVE-2019-2729) represent bypasses of this blacklist, so blacklist-only defenses are insufficient. ↗
CVSS provenance
nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vulncheck7.4HIGH
cisa7.4HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Oracle WebLogic Server OS Command Injection Vulnerability
cisa·2024-06-03·CVSS 7.4
CVE-2017-3506 [HIGH] CWE-78 Oracle WebLogic Server OS Command Injection Vulnerability
Vulnerability: Oracle WebLogic Server OS Command Injection Vulnerability
Affected: Oracle WebLogic Server
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://www.oracle.com/security-alerts/cpuapr2017.html; https://nvd.nist.gov/vuln/detail/CVE-2017-3506
Remediation Due Date: 2024-06-24
GHSA
GHSA-2f3c-chf6-54v5: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services)
ghsa_unreviewed·2022-05-13
CVE-2017-3506 [HIGH] CWE-78 GHSA-2f3c-chf6-54v5: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).
VulnCheck
Oracle WebLogic Server OS Command Injection Vulnerability
vulncheck·2017·CVSS 7.4
CVE-2017-3506 [HIGH] CWE-78 Oracle WebLogic Server OS Command Injection Vulnerability
Oracle WebLogic Server OS Command Injection Vulnerability
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.
Affected: Oracle WebLogic Server
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.trendmicro.com/en_us/research/23/e/8220-gang-evolution-new-strategies-adapted.html; https://www.imperva.com/blog/imperva-detects-undocumented-8220-gang-activities/; https://www.broadcom.com/support/security-center/protection-bulletin/unveiling-cryptocurrency-mining-tactic-of-the-8220-gang; https://
Suricata
ET WEB_SPECIFIC_APPS Oracle WebLogic Server OS Command Injection Attempt Inbound (CVE-2017-3506)
suricata·2023-09-26·CVSS 7.4
CVE-2017-3506 [HIGH] ET WEB_SPECIFIC_APPS Oracle WebLogic Server OS Command Injection Attempt Inbound (CVE-2017-3506)
ET WEB_SPECIFIC_APPS Oracle WebLogic Server OS Command Injection Attempt Inbound (CVE-2017-3506)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Oracle WebLogic Server OS Command Injection Attempt Inbound (CVE-2017-3506)"; flow:established,to_server; http.method; content:"POST"; http.uri; bsize:29; content:"/wls-wsat/coordinatorporttype"; nocase; fast_pattern; http.request_body; content:""; pcre:"/^(?:\x2fbin\x2f|\w+\.exe)/R"; reference:url,www.trendmicro.com/en_us/research/23/e/8220-gang-evolution-new-strategies-adapted.html; reference:url,nvd.nist.gov/vuln/detail/CVE-2017-3606; reference:cve,2017-3506; classtype:attempted-admin; sid:2048259; rev:3; metadata:attack_target Web_Server, created_at 2023_09_26, cve CVE_2017_3506, deployment Perimeter, performanc
Nuclei
Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution
nuclei·CVSS 7.4
CVE-2017-3506 [HIGH] Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution
Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution
The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server.
Template:
id: CVE-2017-3506
info:
name: Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution
author: pdteam
severity: high
description: The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HT
Greynoiseio
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day
blogs_greynoiseio·2025-05-27
Coordinated Cloud-Based Scanning Operation Targets 75 Known Exposure Points in One Day
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Trendmicro
Examining Water Sigbin's Infection Routine Leading to an XMRig Cryptominer
blogs_trendmicro·2024-06-28·CVSS 7.4
CVE-2017-3506 [HIGH] Examining Water Sigbin's Infection Routine Leading to an XMRig Cryptominer
Exploits & Vulnerabilities
# Examining Water Sigbin's Infection Routine Leading to an XMRig Cryptominer
We analyze the multi-stage loading technique used by Water Sigbin to deliver the PureCrypter loader and XMRIG crypto miner.
By: Ahmed Mohamed Ibrahim , Shubham Singh, Sunil Bharti
2024/06/28
Read time: ( words)
Save to Folio
## Summary
- Water Sigbin continues to exploit CVE-2017-3506 and CVE-2023-21839 to deploy cryptocurrency miners via a PowerShell script.
- The threat actor employs fileless execution techniques, using DLL reflective and process injection, allowing the malware code to run solely in memory and avoid disk-based detection mechanisms.
- This blog entry details the multi-stage loading technique that Water Sigbin uses to deliver the PureCrypter loader and XMRig crypt
Checkpoint
3rd June – Threat Intelligence Report
blogs_checkpoint·2024-06-03
CVE-2024-24919 3rd June – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 3rd June – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 3rd June, please download our Threat_Intelligence Bulletin .
TOP ATTACKS AND BREACHES
ShinyHunters, a notorious cybercrime gang offered for sale on a cybercrime forum data of Ticketmaster, ticket sales and distribution company, and of Santander bank. The alleged breaches have resulted in the potential exposure of personal data belonging to millions of customers. Some assumption claim that actor gained access to Ti
Trendmicro
Decoding Water Sigbin's Latest Obfuscation Tricks
blogs_trendmicro·2024-05-30·CVSS 7.4
CVE-2017-3506 [HIGH] Decoding Water Sigbin's Latest Obfuscation Tricks
APT & Targeted Attacks
# Decoding Water Sigbin's Latest Obfuscation Tricks
Water Sigbin (aka the 8220 Gang) exploited Oracle WebLogic vulnerabilities to deploy a cryptocurrency miner using a PowerShell script. The threat actor also adopted new techniques to conceal its activities, making attacks harder to defend against.
By: Sunil Bharti
2024/05/30
Read time: ( words)
Save to Folio
# Summary
- Water Sigbin exploited the vulnerabilities CVE-2017-3506 and CVE-2023-21839 to deploy a cryptocurrency miner via a PowerShell script.
- The gang employed obfuscation techniques, such as hexadecimal encoding of URLs and using HTTP over port 443, allowing for stealthy payload delivery.
- The PowerShell script and the resulting batch file involved complex encoding, using environment variables to
Trendmicro
8220 Gang Evolves With New Strategies
blogs_trendmicro·2023-05-16·CVSS 7.4
CVE-2017-3506 [HIGH] 8220 Gang Evolves With New Strategies
Exploits y vulnerabilidades
## 8220 Gang Evolves With New Strategies
We observed the threat actor group known as “8220 Gang” employing new strategies for their respective campaigns, including exploits for the Linux utility “lwp-download” and CVE-2017-3506, an Oracle WebLogic vulnerability.
By: Sunil Bharti May 16, 2023 Read time: ( words)
Save to Folio
Update as of 7/25/2023 3:40PM PHT: Updated the indicators of compromise.
8220 Gang (also known as “8220 Mining Group,” derived from their use of port 8220 for command and control or C&C communications exchange) has been active since 2017 and continues to scan for vulnerable applications in cloud and container environments. Researchers have documented this group targeting Oracle WebLogic, Apache Log4j , Atlassian Confluence vulnerabilit
Trendmicro
8220 Gang Evolves With New Strategies
blogs_trendmicro·2023-05-16·CVSS 7.4
CVE-2017-3506 [HIGH] 8220 Gang Evolves With New Strategies
Exploits & Vulnerabilities
## 8220 Gang Evolves With New Strategies
We observed the threat actor group known as “8220 Gang” employing new strategies for their respective campaigns, including exploits for the Linux utility “lwp-download” and CVE-2017-3506, an Oracle WebLogic vulnerability.
By: Sunil Bharti 2023/05/16 Read time: ( words)
Save to Folio
Update as of 7/25/2023 3:40PM PHT: Updated the indicators of compromise.
8220 Gang (also known as “8220 Mining Group,” derived from their use of port 8220 for command and control or C&C communications exchange) has been active since 2017 and continues to scan for vulnerable applications in cloud and container environments. Researchers have documented this group targeting Oracle WebLogic, Apache Log4j , Atlassian Confluence vulnerabilities
Trendmicro
8220 Gang Evolves With New Strategies
blogs_trendmicro·2023-05-16·CVSS 7.4
CVE-2017-3506 [HIGH] 8220 Gang Evolves With New Strategies
Exploits & Vulnerabilities
## 8220 Gang Evolves With New Strategies
We observed the threat actor group known as “8220 Gang” employing new strategies for their respective campaigns, including exploits for the Linux utility “lwp-download” and CVE-2017-3506, an Oracle WebLogic vulnerability.
By: Sunil Bharti May 16, 2023 Read time: ( words)
Save to Folio
Update as of 7/25/2023 3:40PM PHT: Updated the indicators of compromise.
8220 Gang (also known as “8220 Mining Group,” derived from their use of port 8220 for command and control or C&C communications exchange) has been active since 2017 and continues to scan for vulnerable applications in cloud and container environments. Researchers have documented this group targeting Oracle WebLogic, Apache Log4j , Atlassian Confluence vulnerabiliti
Trendmicro
8220 Gang Evolves With New Strategies
blogs_trendmicro·2023-05-16·CVSS 7.4
CVE-2017-3506 [HIGH] 8220 Gang Evolves With New Strategies
Sfruttamento vulnerabilità
## 8220 Gang Evolves With New Strategies
We observed the threat actor group known as “8220 Gang” employing new strategies for their respective campaigns, including exploits for the Linux utility “lwp-download” and CVE-2017-3506, an Oracle WebLogic vulnerability.
By: Sunil Bharti May 16, 2023 Read time: ( words)
Save to Folio
Update as of 7/25/2023 3:40PM PHT: Updated the indicators of compromise.
8220 Gang (also known as “8220 Mining Group,” derived from their use of port 8220 for command and control or C&C communications exchange) has been active since 2017 and continues to scan for vulnerable applications in cloud and container environments. Researchers have documented this group targeting Oracle WebLogic, Apache Log4j , Atlassian Confluence vulnerabiliti
Trendmicro
8220 Gang Evolves With New Strategies
blogs_trendmicro·2023-05-16·CVSS 7.4
CVE-2017-3506 [HIGH] 8220 Gang Evolves With New Strategies
Exploits & Vulnerabilities
# 8220 Gang Evolves With New Strategies
We observed the threat actor group known as “8220 Gang” employing new strategies for their respective campaigns, including exploits for the Linux utility “lwp-download” and CVE-2017-3506, an Oracle WebLogic vulnerability.
By: Sunil Bharti
2023/05/16
Read time: ( words)
Save to Folio
Update as of 7/25/2023 3:40PM PHT: Updated the indicators of compromise.
8220 Gang (also known as “8220 Mining Group,” derived from their use of port 8220 for command and control or C&C communications exchange) has been active since 2017 and continues to scan for vulnerable applications in cloud and container environments. Researchers have documented this group targeting Oracle WebLogic, Apache Log4j, Atlassian Confluence vulnerabilities,
Trendmicro
8220 Gang Evolves With New Strategies
blogs_trendmicro·2023-05-16·CVSS 7.4
CVE-2017-3506 [HIGH] 8220 Gang Evolves With New Strategies
Ausnutzung von Schwachstellen
## 8220 Gang Evolves With New Strategies
We observed the threat actor group known as “8220 Gang” employing new strategies for their respective campaigns, including exploits for the Linux utility “lwp-download” and CVE-2017-3506, an Oracle WebLogic vulnerability.
By: Sunil Bharti May 16, 2023 Read time: ( words)
Save to Folio
Update as of 7/25/2023 3:40PM PHT: Updated the indicators of compromise.
8220 Gang (also known as “8220 Mining Group,” derived from their use of port 8220 for command and control or C&C communications exchange) has been active since 2017 and continues to scan for vulnerable applications in cloud and container environments. Researchers have documented this group targeting Oracle WebLogic, Apache Log4j , Atlassian Confluence vulnerabil
Trendmicro
Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
blogs_trendmicro·2019-06-25·CVSS 7.4
CVE-2019-2729 [HIGH] Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Exploits y vulnerabilidades
## Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability in an out-of-band security patch.
By: Sivathmican Sivakumaran Jun 25, 2019 Read time: ( words)
Save to Folio
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability, CVE-2019-2729 , in an out-of-band security patch on June 18, 2019.
CVE-2019-2729 was assigned a CVSS score of 9.8, making it a critical vulnerability. This vulnerability is rela
Trendmicro
Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
blogs_trendmicro·2019-06-25·CVSS 7.4
CVE-2019-2729 [HIGH] Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Exploits & Vulnerabilities
## Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability in an out-of-band security patch.
By: Sivathmican Sivakumaran Jun 25, 2019 Read time: ( words)
Save to Folio
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability, CVE-2019-2729 , in an out-of-band security patch on June 18, 2019.
CVE-2019-2729 was assigned a CVSS score of 9.8, making it a critical vulnerability. This vulnerability is relat
Trendmicro
Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
blogs_trendmicro·2019-06-25·CVSS 7.4
CVE-2019-2729 [HIGH] Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Exploits & Vulnerabilities
# Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability in an out-of-band security patch.
By: Sivathmican Sivakumaran
2019/06/25
Read time: ( words)
Save to Folio
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability, CVE-2019-2729, in an out-of-band security patch on June 18, 2019.
CVE-2019-2729 was assigned a CVSS score of 9.8, making it a critical vulnerability. This vulnerability is relative
Trendmicro
Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
blogs_trendmicro·2019-06-25·CVSS 7.4
CVE-2019-2729 [HIGH] Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Ausnutzung von Schwachstellen
## Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability in an out-of-band security patch.
By: Sivathmican Sivakumaran Jun 25, 2019 Read time: ( words)
Save to Folio
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability, CVE-2019-2729 , in an out-of-band security patch on June 18, 2019.
CVE-2019-2729 was assigned a CVSS score of 9.8, making it a critical vulnerability. This vulnerability is re
Trendmicro
Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
blogs_trendmicro·2019-06-25·CVSS 7.4
CVE-2019-2729 [HIGH] Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Exploits & Vulnerabilities
## Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability in an out-of-band security patch.
By: Sivathmican Sivakumaran 2019/06/25 Read time: ( words)
Save to Folio
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability, CVE-2019-2729 , in an out-of-band security patch on June 18, 2019.
CVE-2019-2729 was assigned a CVSS score of 9.8, making it a critical vulnerability. This vulnerability is relativ
Trendmicro
Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
blogs_trendmicro·2019-06-25·CVSS 7.4
CVE-2019-2729 [HIGH] Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Sfruttamento vulnerabilità
## Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability in an out-of-band security patch.
By: Sivathmican Sivakumaran Jun 25, 2019 Read time: ( words)
Save to Folio
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability, CVE-2019-2729 , in an out-of-band security patch on June 18, 2019.
CVE-2019-2729 was assigned a CVSS score of 9.8, making it a critical vulnerability. This vulnerability is relat
Trendmicro
Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
blogs_trendmicro·2019-06-25·CVSS 7.4
CVE-2019-2729 [HIGH] Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Exploits & Vulnerabilities
# Remediating an RCE (CVE-2019-2729) in Oracle WebLogic
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability in an out-of-band security patch.
By: Sivathmican Sivakumaran
Jun 25, 2019
Read time: ( words)
Save to Folio
Oracle WebLogic has recently disclosed and patched remote-code-execution (RCE) vulnerabilities in its software, many of which were due to insecure deserialization. Oracle addressed the most recent vulnerability, CVE-2019-2729, in an out-of-band security patch on June 18, 2019.
CVE-2019-2729 was assigned a CVSS score of 9.8, making it a critical vulnerability. This vulnerability is relati
Talos
Ransom Where? Malicious Cryptocurrency Miners Takeover, Generating Millions
blogs_talos·2018-01-31
Ransom Where? Malicious Cryptocurrency Miners Takeover, Generating Millions
his post was authored by Nick Biasini, Edmund Brumaghin, Warren Mercer and Josh Reynolds with contributions from Azim Khodijbaev and David Liebenberg.
## Executive Summary
The threat landscape is constantly changing; over the last few years malware threat vectors, methods and payloads have rapidly evolved. Recently, as cryptocurrency values have exploded, mining related attacks have emerged as a primary interest for many attackers who are beginning to recognize that they can realize all of the financial upside of previous attacks, like ransomware, without needing to actually engage the victim and without the extraneous law enforcement attention that comes with ransomware attacks.
This focus on mining isn't entirely surprising, considering that various cryptocurrencies along with "blockc
Talos
Ransom Where? Malicious Cryptocurrency Miners Takeover, Generating Millions
blogs_talos·2018-01-31
Ransom Where? Malicious Cryptocurrency Miners Takeover, Generating Millions
## Ransom Where? Malicious Cryptocurrency Miners Takeover, Generating Millions
his post was authored by Nick Biasini , Edmund Brumaghin , Warren Mercer and Josh Reynolds with contributions from Azim Khodijbaev and David Liebenberg .
## Executive Summary
The threat landscape is constantly changing; over the last few years malware threat vectors, methods and payloads have rapidly evolved. Recently, as cryptocurrency values have exploded, mining related attacks have emerged as a primary interest for many attackers who are beginning to recognize that they can realize all of the financial upside of previous attacks, like ransomware, without needing to actually engage the victim and without the extraneous law enforcement attention that comes with ransomware attacks. This focus on mining isn't
Greynoiseio
NoiseLetter June 2024
blogs_greynoiseio
NoiseLetter June 2024
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Threat Intel
Water Sigbin
threat_intel·CVSS 7.4
CVE-2017-3506 [HIGH] Water Sigbin
# Threat Actor: Water Sigbin
## Description
The 8220 Gang, also known as Water Sigbin, is a threat actor group that focuses on deploying cryptocurrency-mining malware. They exploit vulnerabilities in Oracle WebLogic servers, such as CVE-2017-3506 and CVE-2023-21839, to deliver cryptocurrency miners using PowerShell scripts. The group has demonstrated a sophisticated multistage loading technique to deploy the PureCrypter loader and XMRIG crypto miner. They are known for using obfuscation techniques, such as hexadecimal encoding and code obfuscation, to evade detection and compromise systems.
arXiv
AEAS: Actionable Exploit Assessment System
arxiv_fulltext·2025-09-22
AEAS: Actionable Exploit Assessment System
: Actionable Exploit Assessment System
Xiangmin Shen1,
Wenyuan Cheng2,
Yan Chen3,
Zhenyuan Li2,
Yuqiao Gu2,
Lingzhi Wang3,
Wencheng Zhao4,
Dawei Sun4 and
Jiashui Wang2
1Hofstra University, 2Zhejiang University, 3Northwestern University, 4Ant Group
## Abstract
Security practitioners face growing challenges in exploit assessment, as public vulnerability repositories are increasingly populated with inconsistent and low-quality exploit artifacts. Existing scoring systems such as CVSS and EPSS offer limited support for this task. They either rely on theoretical metrics or produce opaque probability estimates without assessing whether usable exploit code exists. In practice, security teams often resort to manual triage of exploit repositories, which is time-consuming, error-prone, and diffic
arXiv
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights
arxiv_fulltext·2024-07-31
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights
Microservice Vulnerability Analysis: A Literature Review with Empirical Insights
Raveen Kanishka Jayalath*
University of Adelaide, Australia
[email protected]
Hussain Ahmad* *Authors contributed equally to this work. Corresponding author.
University of Adelaide, Australia
[email protected]
Diksha Goel
CSIRO's Data61, Australia
[email protected]
3cmMuhammad Shuja Syed
3cmSLB, USA
[email protected]
Faheem Ullah
University of Adelaide, Australia
[email protected]
plain
## Abstract
Microservice architectures are revolutionizing both small businesses and large corporations, igniting a new era of innovation with their exceptional advantages in maintainability, reusability, and scalability. However, these benefits come w
HackerOne
Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-3506]
hackerone·2021-04-25·CVSS 7.4
CVE-2017-3506 [HIGH] Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-3506]
Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-3506]
##Summary
Hello. I was able to identify RCE vulnerability due to the outdated Oracle Weblogic instance on `https://raebilling.mtn.co.za`.
##Steps To Reproduce
* To reproduce, try this request with BurpSuite
* This request to the `https://raebilling.mtn.co.za/wls-wsat/RegistrationRequesterPortType` will trigger Remote OS Command Execution:
```
POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1
Host: raebilling.mtn.co.za
Content-Type: text/xml
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0,
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
Accept-Languag: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3,
Content-Type: text/xml;charset=UTF-8
Content-Length: 87
http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlhttp://www.securityfocus.com/bid/97884http://www.securitytracker.com/id/1038296http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlhttp://www.securityfocus.com/bid/97884http://www.securitytracker.com/id/1038296https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-3506
2017-04-24
Published
2024-06-03
Added to CISA KEV
Exploited in the wild