CVE-2018-2893

published 2018-07-18

CVE-2018-2893: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are…

Priority P1 92 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV Initial access

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected

8 ranges

Vendor	Product	Version range	Fixed in
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—
oracle_corporation	weblogic_server	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 7001↗

other StreamMessageImpl cannot be cast to weblogic

bytes

t3 12.2.1\nAS:255\nHL:19\nMS:10000000\nPU:t3://us-l-breens:7001

bytes

000005c3016501ffffffffffffffff0000006a0000ea600000001900937b484a56fa4a777666f581daa4f5b90e2aebfc607499b4027973720078720178720278700000000a000000030000000000000006007070707070700000000a000000030000000000000006007006fe010000aced00057372001d7765626c6f6769632e726a766d2e436c6173735461626c65456e7472792f52658157f4f9ed0c000078707200247765626c6f6769632e636f6d6d6f6e2e696e7465726e616c2e5061636b616765496e666fe6f723e7b8ae1ec9

snort

alert tcp any any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Oracle WebLogic Deserialization (CVE-2018-2893)"; flow:established,to_server; content:"t3|20|12"; depth:5; fast_pattern; content:"AS|3a|255"; distance:0; content:"HL|3a|19"; distance:0; content:"MS|3a|10000000"; distance:0; content:"PU|3a|t3|3a|//"; distance:0; reference:cve,2018-2893; reference:url,github.com/pyn3rd/CVE-2018-2893; classtype:attempted-admin; sid:2025929; rev:3; metadata:affected_product Web_Server_Applications, attack_target Server, created_at 2018_08_01, cve CVE_2018_2893, deployment Datacenter, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_05_21;)

• → Exploit traffic uses the T3 protocol; detect by matching the T3 handshake banner pattern 't3|20|12' at depth 5, followed by AS:255, HL:19, MS:10000000, and PU:t3:// fields in the same TCP stream directed to WebLogic listeners (default port 7001).
• → A vulnerable WebLogic server responding to the exploit probe will return a response containing the string 'StreamMessageImpl cannot be cast to weblogic', which can be used as a positive confirmation matcher.
• → The exploit sends a multi-stage TCP payload beginning with a T3 handshake followed by serialized Java object data (hex-encoded) over the T3 protocol; the serialized stream starts with the magic bytes 'aced0005' (Java serialization header) embedded within the larger T3 payload.
• → Shodan and FOFA queries can identify exposed Oracle WebLogic instances for asset discovery: Shodan 'product:"oracle weblogic"' or FOFA/Google 'title="oracle peoplesoft sign-in"'.
• → Exploitation was observed in the wild as early as July 21, 2018 — only 4 days after the July 17 patch — so unpatched WebLogic servers on versions 10.3.6.0, 12.1.3.0, 12.2.1.2, and 12.2.1.3 should be treated as actively targeted. ↗

• · The Nuclei template probe uses a hardcoded internal hostname ('us-l-breens') in the T3 PU field; real attacker payloads will use their own callback host, so detections should not rely on matching this specific hostname.
• · Reports surfaced suggesting ways to bypass the July 2018 Oracle patch; defenders should verify patch level and not assume patched systems are fully protected until Oracle confirms. ↗
• · The Nuclei template targets both the default hostname port and explicitly port 7001; environments running WebLogic on non-standard ports may not be covered by default detection rules.

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.