UPDATE: On November 2, 2020, Oracle released an out-of-band security patch to address this vulnerability.
THE THREAT
Earlier this week on October 28, 2020 [1] , technical details of the Oracle Remote Code Execution (RCE) vulnerability CVE-2020-14882 were publicly released, and eSentire published an advisory on the topic. On October 30th, 2020, outside researchers confirmed that the Oracle patch for CVE-2020-14882 can be bypassed and is not effective in defending against attacks [2]. Additionally, Proof-of-Concept (PoC) exploit code is now publicly available and attacks exploiting the vulnerability have been publicly identified in the wild [3] [4].
CVE-2020-14882 affects multiple versions of the Oracle WebLogic Server. Exploitation of CVE-2020-14882 is considered trivial and can result in the full takeover of vulnerable Oracle WebLogic Servers.
Organizations employing vulnerable Oracle instances should refer to the What You Should Do About It section of this report for mitigation recommendations.
What we’re doing about it
- MVS has a local plugin to identify this vulnerability
- Successful authenticated scans against Oracle WebLogic servers since October 22nd, 2020, would have highlighted this vulnerability - for assistance or confirmation, please contact your MVS consultant or the eSentire Security Operations Center (SOC)
- eSentire security teams continue to track this topic for additional details and detection opportunities
What you should do about it
- Until updated security patches are released by Oracle, organizations are recommended to close Weblogic background /console/console.portal external access authority [2]
- Monitor for network traffic and logs for suspicious activity
- Review application logs for suspicious:
- Request URIs that include “console.portal”
- HTTP requests which include double-encoded path traversal “%252E%252E%252F” [5]
- Apply the updated Oracle patch once it has been made available
Additional information
CVE-2020-14882 received a base criticality rating of 9.8 out of 10.
The vulnerability resides in the Oracle WebLogic Server product of Oracle Fusion Middleware. In order to exploit CVE-2020-14882, a threat actor requires network access via HTTP. Exploitation is achieved via a malicious POST request.
In the October Oracle patch on October 21st, multiple other critical vulnerabilities were released. Other vulnerabilities of specific note include CVE-2020-14841, CVE-2020-14825, and CVE-2020-14859. Organizations are recommended to ensure that all Oracle systems are up to date with the most recent security updates.
Affected Oracle Versions:
- 10.3.6.0.0
- 12.1.3.0.0
- 12.2.1.3.0
- 12.2.1.4.0
- 14.1.1.0.0.
References:
[1] https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
[2] https://meterpreter.org/cve-2020-14882-weblogic-console-remote-code-execution-vulnerability-patch-bypass-alert/
[3] https://github.com/jas502n/CVE-2020-14882
[4] https://www.tenable.com/blog/cve-2020-14882-oracle-weblogic-remote-code-execution-vulnerability-exploited-in-the-wild
[5] https://blog.rapid7.com/2020/10/29/oracle-weblogic-unauthenticated-complete-takeover-cve-2020-14882-what-you-need-to-know/
