CVE-2018-2894
published 2018-07-18CVE-2018-2894: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are…
PriorityP194critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVRansomwareInitial access
Exploited in the wild
EPSS
50.22%
98.8th percentile
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/ws_utc/resources/setting/options
url/ws_utc/resources/setting/keystore
url/ws_utc/css/config/keystore/
path/u01/oracle/user_projects/domains/base_domain/servers/AdminServer/tmp/_WL_internal/com.oracle.webservices.wls.ws-testclient-app-wls/4mcj4y/war/css
snort
alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Oracle WebLogic Unrestricted File Upload (CVE-2018-2894)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ws_utc/resources/setting/keystore"; fast_pattern; http.request_body; content:"ks_filename="; reference:url,github.com/LandGrey/CVE-2018-2894/blob/master/CVE-2018-2894.py; reference:cve,2018-2894; classtype:attempted-admin; sid:2025907; rev:4; metadata:attack_target Server, created_at 2018_07_25, cve CVE_2018_2894, deployment Datacenter, signature_severity Major, updated_at 2024_03_07;)
- →Detect exploitation attempt by monitoring for POST requests to /ws_utc/resources/setting/keystore containing the multipart field 'ks_filename=' — this is the unrestricted file upload vector used to plant a JSP webshell.
- →Detect the workDir manipulation stage: a POST to /ws_utc/resources/setting/options with a body setting BasicConfigOptions.workDir to a web-accessible path (e.g. under /war/css) redirects subsequent uploads to a location reachable via HTTP.
- →Detect webshell access: monitor for GET requests matching the pattern /ws_utc/css/config/keystore/<timestamp>_<name>.jsp — a successful upload followed by a GET to this path indicates active exploitation.
- →The Nuclei template uses the string '26ec00a3a03f6bfc5226fd121567bb58' as a canary word in the uploaded JSP payload; presence of this string in HTTP responses indicates a confirmed vulnerable and exploited instance.
- →Use Shodan/FOFA queries to identify exposed Oracle WebLogic instances as potential targets: search for http.title 'oracle peoplesoft sign-in' or product 'oracle weblogic'.
- ·The workDir path used in the exploit is specific to a default WebLogic domain layout. Actual deployments may use different domain names or paths, so the hardcoded path in the POST body may vary in real-world attacks.
- ·The multipart boundary '----WebKitFormBoundaryuim0dyiDSPBPu31g' is static in the Nuclei PoC template but may differ in other exploit implementations; detection should not rely solely on this boundary value.
- ·The Nuclei template targets the intrusive/vuln category and sends a real file upload; running this template against production systems will write files to disk.
CVSS provenance
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h624-pqg4-29mh: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)
ghsa_unreviewed·2022-05-13
CVE-2018-2894 [CRITICAL] GHSA-h624-pqg4-29mh: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services)
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
VulnCheck
Oracle Fusion Middleware WebLogic Server Unauthenticated Security Bypass
vulncheck·2018·CVSS 9.8
CVE-2018-2894 [CRITICAL] Oracle Fusion Middleware WebLogic Server Unauthenticated Security Bypass
Oracle Fusion Middleware WebLogic Server Unauthenticated Security Bypass
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected: Oracle WebLogic Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigatio
Suricata
ET EXPLOIT Oracle WebLogic Unrestricted File Upload (CVE-2018-2894)
suricata·2018-07-25·CVSS 9.8
CVE-2018-2894 [CRITICAL] ET EXPLOIT Oracle WebLogic Unrestricted File Upload (CVE-2018-2894)
ET EXPLOIT Oracle WebLogic Unrestricted File Upload (CVE-2018-2894)
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET EXPLOIT Oracle WebLogic Unrestricted File Upload (CVE-2018-2894)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/ws_utc/resources/setting/keystore"; fast_pattern; http.request_body; content:"ks_filename="; reference:url,github.com/LandGrey/CVE-2018-2894/blob/master/CVE-2018-2894.py; reference:cve,2018-2894; classtype:attempted-admin; sid:2025907; rev:4; metadata:attack_target Server, created_at 2018_07_25, cve CVE_2018_2894, deployment Datacenter, signature_severity Major, updated_at 2024_03_07;)
Nuclei
Oracle WebLogic Server - Remote Code Execution
nuclei·CVSS 9.8
CVE-2018-2894 [CRITICAL] Oracle WebLogic Server - Remote Code Execution
Oracle WebLogic Server - Remote Code Execution
The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services) is susceptible to a remote code execution vulnerability that is easily exploitable and could allow unauthenticated attackers with network access via HTTP to compromise the server. Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3.
Template:
id: CVE-2018-2894
info:
name: Oracle WebLogic Server - Remote Code Execution
author: geeknik,pdteam
severity: critical
description: |
The Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services) is susceptible to a remote code execution vulnerability that is easily exploitable and could allow unauthenticated attackers with network access via HT
Fortinet
A Closer Look at Satan Ransomware’s Propagation Techniques
blogs_fortinet·2019-05-20·CVSS 5.3
[MEDIUM] A Closer Look at Satan Ransomware’s Propagation Techniques
FORTIGUARD LABS THREAT RESEARCH
A Closer Look at Satan Ransomware’s Propagation Techniques
By David Maciejak and Floser Bacurio Jr. | May 20, 2019
FortiGuard Labs Breaking Threat Research
Satan ransomware first appeared in early 2017, and since then threat actors have been constantly improving the malware to infect its victims more effectively and to maximize its profits. For instance, FortiGuard Labs has discovered a campaign which was also utilizing a cryptominer malware as an additional payload to maximize its profits from its victims.
Aside from the fact that this file-encrypting malware targets both Linux and Windows platform, it also employs numerous vulnerabilities to propagate itself through public and external networks. In fact, FortiGuard Labs has discovered a new variant t
Checkpoint
SpeakUp: A New Undetected Backdoor Linux Trojan
blogs_checkpoint·2019-02-04
CVE-2018-20062 SpeakUp: A New Undetected Backdoor Linux Trojan
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## SpeakUp: A New Undetected Backdoor Linux Trojan
Check Point Research has discovered a new campaign exploiting Linux servers to implant a new Backdoor Trojan.
Dubbed ‘SpeakUp’, the new Tro
Greynoiseio
NoiseLetter
blogs_greynoiseio·CVSS 10.0
[CRITICAL] NoiseLetter
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.securityfocus.com/bid/104763http://www.securitytracker.com/id/1041301http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.htmlhttp://www.securityfocus.com/bid/104763http://www.securitytracker.com/id/1041301
2018-07-18
Published
Exploited in the wild