CVE-2021-2135
published 2021-04-22CVE-2021-2135: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are…
PriorityP185critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
8.37%
94.3th percentile
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
| oracle_corporation | weblogic_server | — | — |
Detection & IOCsextracted from sources · hover to see the quote
port7001
bytes
743320372e302e302e300a41533a31300a484c3a31390a0a
- →Detect the T3 handshake initiation string 't3 7.0.0\nAS:10\nHL:19\n\n' (hex: 743320372e302e302e300a41533a31300a484c3a31390a0a) sent over TCP to port 7001 immediately before a large serialized payload — characteristic of this exploit chain.
- →Alert on DNS/HTTP callbacks containing the strings 'rce-linux' or 'rce-window' in the request, which are the OAST beacon identifiers used by the public exploit template to confirm successful code execution.
- →Look for the Java gadget chain invoking 'java.lang.Runtime.getRuntime().exec()' via the MvelExtractor class ('com.tangosol.coherence.rest.util.extractor.MvelExtractor') in deserialized T3/IIOP payloads — the exploit embeds this as hex-encoded bytecode in the serialized stream.
- →Shodan/FOFA exposure queries for identifying internet-facing vulnerable WebLogic instances: search for cpe:"cpe:2.3:a:oracle:weblogic_server", product:"WebLogic", http.server:"WebLogic", or port:7001.
- →FOFA query to identify exposed WebLogic servers: product="WebLogic" || header="WebLogic Server".
- ·The exploit targets T3 and IIOP protocols; organizations that have blocked T3/IIOP at the network perimeter (firewall rules on port 7001) may not be directly reachable, but the vulnerability is still present in unpatched software. ↗
- ·The public Nuclei template uses out-of-band (OAST/interactsh) DNS callbacks to confirm exploitation; detection based solely on inbound traffic may miss successful exploitation if OAST infrastructure is not monitored.
- ·Affected versions are specifically 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0; detection rules should be scoped to these versions to reduce false positives on patched or out-of-scope deployments. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
vendor_oracle9.8CRITICAL
vendor_redhat5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vrrf-frmq-98j4: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container)
ghsa_unreviewed·2022-05-24
CVE-2021-2135 [CRITICAL] GHSA-vrrf-frmq-98j4: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
VulnCheck
Oracle Fusion Middleware WebLogic Server Coherence Container Security Bypass
vulncheck·2021·CVSS 9.8
CVE-2021-2135 [CRITICAL] Oracle Fusion Middleware WebLogic Server Coherence Container Security Bypass
Oracle Fusion Middleware WebLogic Server Coherence Container Security Bypass
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected: Oracle WebLogic Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or
Red Hat
kernel: mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
vendor_redhat·2024-03-04·CVSS 5.5
CVE-2021-47090 [MEDIUM] CWE-20 kernel: mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
kernel: mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
In the Linux kernel, the following vulnerability has been resolved:
mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()
Hulk Robot reported a panic in put_page_testzero() when testing
madvise() with MADV_SOFT_OFFLINE. The BUG() is triggered when retrying
get_any_page(). This is because we keep MF_COUNT_INCREASED flag in
second try but the refcnt is not increased.
page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:737!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 5 PID: 2135 Comm: sshd Tainted: G B 5.16.0-rc6-dirty #373
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: releas
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Coherence Container — CVE-2021-2135
vendor_oracle·2021-04-15·CVSS 9.8
CVE-2021-2135 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: Coherence Container — CVE-2021-2135
Oracle Oracle Fusion Middleware Risk Matrix: Coherence Container vulnerability
CVE: CVE-2021-2135
CVSS: 9.8
Protocol: T3, IIOP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2021 (APR 2021)
No detection rules found.
Nuclei
Oracle WebLogic Server - Remote Code Execution
nuclei·CVSS 9.8
CVE-2021-2135 [CRITICAL] Oracle WebLogic Server - Remote Code Execution
Oracle WebLogic Server - Remote Code Execution
Oracle WebLogic Server (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) contains a remote code execution caused by unauthenticated access via T3, IIOP, letting attackers take over the server, exploit requires network access.
Template:
id: CVE-2021-2135
info:
name: Oracle WebLogic Server - Remote Code Execution
author: hnd3884
severity: critical
description: |
Oracle WebLogic Server (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0) contains a remote code execution caused by unauthenticated access via T3, IIOP, letting attackers take over the server, exploit requires network access.
impact: |
Attackers can fully compromise the server, leading to data breach, service disruption, and potential further exploitation.
remediation: |
Update to the latest patched version o
No writeups or analysis indexed.
2021-04-22
Published
Exploited in the wild