Oracle WebLogic vulnerability being exploited

Oracle has stated the vulnerability affects users of WebLogic Server versions:

• 10.3.6.0.0
• 12.1.3.0.0
• 12.2.1.3.0

Oracle also notes that older versions are likely to be affected, but as they do not test these versions for vulnerabilities, they cannot confirm this.

According to Oracle, there is a deserialisation vulnerability via XMLDecoder in WebLogic Server Web Services. This vulnerability is remotely exploitable without authentication, meaning that it can be exploited over a network without login credentials.

Attackers are able to exploit these vulnerabilities to run their own code. Previously, similar vulnerabilities have been used to run mining software for cryptocurrency. It is possible that more malicious attacks will be carried out through this vector.

There is conflicting information about exactly which vulnerabilities are being currently exploited. Security researchers Knownsec claimed that the attacks exploited a WebLogic flaw to bypass patches for a previous zero-day WebLogic vulnerability, CVE-2019-2725.

Oracle has claimed that the vulnerability has emerged from a separate zero-day, CVE-2019-2729. A patch has been released for this vulnerability. 

You are affected by this vulnerability if you are using WebLogic Server versions:

• 10.3.6.0.0
• 12.1.3.0.0
• 12.2.1.3.0

Oracle also notes that older versions are likely to be affected, but as they do not test these versions for vulnerabilities, they cannot confirm this.

Make sure you are using a supported WebLogic server and immediately apply the patches released by Oracle.  

In addition to patching CERT NZ recommends you take further measures, including:

• planning for out-of-cycle patches
• engaging with Oracle about upcoming patches
• monitoring effectiveness of patches and future bypasses
• implementing defence-in-depth processes such as web app firewalls and any other controls relevant to your network.

Implement the patches released by Oracle immediately.

If you are running an unsupported version, Oracle recommends upgrading to a supported version as soon as possible.

Operating system controls such as SELinux or Apparmor could be used to mitigate the impact of an attack. When correctly implemented, these controls limit the resources that the affected process has access to.

Oracle’s advisory for CVE-2019-2729 vulnerability External Link