CVE-2015-4852
CVE-2015-4852
In short
Oracle WebLogic Server has a critical vulnerability in its security component that allows attackers to execute arbitrary commands by sending specially crafted messages over the network. This happens because the server unsafely processes serialized Java objects without proper validation.
Technical detail
The WLS Security component improperly deserializes untrusted T3 protocol messages on TCP port 7001, leveraging the Apache Commons Collections library to achieve remote code execution. An unauthenticated attacker can send a crafted serialized object to instantiate arbitrary classes and execute commands with WebLogic server privileges.
Summary generated and translated by AI from the official description.
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 10
githubgithub.com/roo7break/serialator★ 31githubgithub.com/zhzhdoai/Weblogic_Vuln★ 17githubgithub.com/AndersonSingh/serialization-vulnerability-scanner★ 2githubgithub.com/nex1less/CVE-2015-4852★ 1exploitdbwww.exploit-db.com/exploits/46628unverifiedcve_referencepacketstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.htmlunverifiedexploitdbwww.exploit-db.com/exploits/44552unverifiedcve_referencewww.exploit-db.com/exploits/42806/unverifiedcve_referencewww.exploit-db.com/exploits/46628/unverifiedexploitdbwww.exploit-db.com/exploits/42806unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →References
http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/http://packetstormsecurity.com/files/152268/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.htmlhttps://blogs.oracle.com/security/entry/security_alert_cve_2015_4852https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/weblogic.pyhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-4852https://www.exploit-db.com/exploits/42806/https://www.exploit-db.com/exploits/46628/http://www.openwall.com/lists/oss-security/2015/11/17/19http://www.oracle.com/technetwork/security-advisory/cpuapr2017-3236618.htmlhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.htmlhttp://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html