Home » Security Bloggers Network » CVE-2020-14882: WebLogic RCE Via GET Request

CVE-2020-14882: WebLogic RCE Via GET Request

Virsec Security Research Lab Vulnerability Report

The Virsec Security Research Lab, helmed by Virsec CTO, Satya Gupta, provides timely, relevant analysis about prevalent security vulnerabilities.

1.1        Vulnerability Summary

An OS Command Injection vulnerability exists in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). This easily exploitable vulnerability allows an unauthenticated attacker with HTTP based network access to compromise the Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.

Watch the video to learn more about this and other important vulnerabilities.

1.2        CVSS Score

The CVSS Base Score is 9.8 (Critical)

1.3        Affected Version

The vulnerable Oracle WebLogic Affected Versions

• 3.6.0.0
• 1.3.0.0
• 2.1.3.0
• 2.1.4.0
• 1.1.0.0

1.4        Vulnerability Attribution

This was disclosed by security researcher Voidfyoo from Chaitin Security Research Lab.

1.5        Risk Impact

Public domain exploit exists for this vulnerability. Oracle WebLogic Server is a Java EE application server currently developed by Oracle Corporation. Oracle acquired WebLogic Server when it purchased BEA Systems in 2008.

Any exploit of this vulnerabilities could lead to exposure of all sensitive data that resides on the server via backdoor which could be doing data exfiltration to CnC server.

1.6        Virsec Security Platform (VSP) Support:

The Virsec Security Platform (VSP)-Host monitors processes that are spawned which are not part of a set of whitelisted process. Any attempt to execute new command or unknown binary would be denied by VSP-Host’s Process Monitoring capability.

1.7        Reference Links:

• https://nvd.nist.gov/vuln/detail/CVE-2020-16898
• https://www.mcafee.com/blogs/other-blogs/mcafee-labs/cve-2020-16898-bad-neighbor/

Download the full vulnerability report to learn more about this and other important vulnerabilities.