7-year-old Oracle WebLogic bug under active exploitation

A seven-year-old Oracle vulnerability is the latest to be added to CISA's Known Exploited Vulnerability (KEV) catalog, meaning the security agency considers it a significant threat to federal government. CVE-2017-3506 affects Oracle's WebLogic Server, allowing for remote command execution on affected operating systems. …

[Anonymous Coward]

How to GetShell on CVE-2017-3506(Weblogic XMLDecoder Serialization)

This is a poc of CVE-2017-3506(Weblogic XMLDecoder Serialization)

Attackers can achieve remote code execution via specially crafted HTTP requests.

a. It's been well known for ages that Java Serialization doesn't come with any security mechanisms.

b. Never use web protocols on your security device /s

c. I figure this is the quality of code you get when hiring on Indian programmers at $25 an hour /s

d. Oracle fiscal year 2024 net profits: $3.76 billion.

[F. Frederick Skitty]

Re: How to GetShell on CVE-2017-3506(Weblogic XMLDecoder Serialization)

Oracle's Java products were mostly being worked on by their St Petersburg office based on my experience of submitting bug reports about them. That's the St Petersburg in Leningrad Oblast, Russia rather than one in Florida, USA. I suspect the need to move development elsewhere has slowed down Oracle's already glacial bug fixing...

[CowHorseFrog]

Re: How to GetShell on CVE-2017-3506(Weblogic XMLDecoder Serialization)

As opposed to the value of multi million American managers who cant even code at all ?

[sitta_europea]

"The use of sophisticated obfuscation techniques such as hexadecimal encoding of URLs..."

Ah, that's what "sophisticated" means. I'd been wondering, since so many of them seem to be described in that way.

Blimey. Hexadecimal encoding. Never would have thought of that.

[Anonymous Coward]

Sophisticated obfuscation techniques :o

> hexadecimal encoding .. PowerShell .. batch scripts .. environment variables .. layered obfuscation .. malicious code .. benign scripts ..

This is so last century. Real malware writers hide the payload in virtual machine code. The virtual machine being an emulator for an architecture that doesn't exist.

-------

sitta_europea:

> "The use of sophisticated obfuscation techniques such as hexadecimal encoding of URLs..."

> Ah, that's what "sophisticated" means. I'd been wondering, since so many of them seem to be described in that way.

> Blimey. Hexadecimal encoding. Never would have thought of that.

[CowHorseFrog]

You would have thought that with all those billions in profits weblogic would have ripped out all java.io.Serializables...