WebLogic Remote Code Execution Vulnerability CVE-2020-2551

<div><div style="text-align:justify;"><strong>Introduction</strong></div><div style="text-align:justify;"> </div><div style="text-align:justify;">WebLogic, from Oracle, is a Java application server for developing, integrating, deploying, and managing large-scale distributed Web applications, network applications, and database applications.  WebLogic started are the first commercially successful Java (J2EE) application server and is still one of the leaders in the marketspace.</div><div style="text-align:justify;"> </div><div style="text-align:justify;">This is a technical analysis of how the WebLogic Remote Code Execution (CVE-2020-2551) vulnerability is exploited.</div><div style="text-align:justify;"> </div><div style="text-align:justify;"><strong>Summary</strong></div><div style="text-align:justify;"> </div><div style="text-align:justify;">WebLogic Remote Code Execution (CVE-2020-2551) can bypass the security patch released by Oracle in Oct 2019. The IIOP accesses remote objects through a Java interface which is enabled by default. The attacker can remotely access this interface without authentication on the WebLogic Server through IIOP, send carefully constructed data and execute arbitrary code on the target server. CVSS score is 9.8.</div><div style="text-align:justify;"> </div><div style="text-align:justify;"><strong>Analysis</strong></div><div style="text-align:justify;"> </div><div style="text-align:justify;">Using WebLogic 10.3.6.0 as the vulnerability environment for analysis, when sending deserialized data to the server through the IIOP protocol, we can see our incoming IIOP data in the parameters of WebLogic.iiop.MuxableSocketIIOP.dispatch.</div><div style="text-align:justify;"> </div><div style="text-align:justify;">Next, we call the handleRequest () method in the run () method in the WebLogic.rmi.internal.wls.WLSExecuteRequest class</div><div style="text-align:justify;"> </div><div style="text-align:justify;">In the handleRequest () method, there is the runAS () method, and the invoke () method in the WebLogic.rmi.cluster.ClusterableServerRef class can be called through the invoke () method.</div><div style="text-align:justify;"> </div><div style="text-align:justify;">We can call the invoke () method in the WebLogic.corba.idl.CorbaServerRef class using the above method.</div><div style="text-align:justify;"></div><div style="text-align:justify;">First, the code will determine whether the link exists, if not, the code will directly throw an exception. After that, it will determine whether var4.getmethod () is empty. If yes, it will call the delegate._invoke () method.</div><div style="text-align:justify;"></div><div style="text-align:justify;">Since var4 type is bind_any (), and objectMethods do not include this type, it enters delegate._invoke () method.</div><div style="text-align:justify;"> </div><div style="text-align:justify;">Since the value corresponding to bind_any is 0, it will enter the code branch of case 0 later.</div><div style="text-align:justify;"> </div><div style="text-align:justify;">Calling the read_any () method will eventually enter the read_value_internal () method in the WebLogic.corba.idl.AnyImpl class and call the read_value () method for deserialization.</div><div style="text-align:justify;"></div><div style="text-align:justify;">In the WebLogic.iiop.IIOPInputStream.read_value () method, the instance of the class passed in the IIOP data is obtained through deserialization.</div><div style="text-align:justify;"> </div><div style="text-align:justify;">After that, WebLogic.corba.utils.ValueHandlerImpl.readValueData () method will be called to read the content.</div><div style="text-align:justify;"></div><div style="text-align:justify;">We enter the com.bea.core.repackaged.springframework.transaction.jta.JtaTransactionManager class through this.readObjectMethod.invoke () method.</div><div style="text-align:justify;"></div><div style="text-align:justify;">We enter the initUserTransactionAndTransactionManager () method, load the malicious file on the remote server through jndi addressing, and execute arbitrary code.</div><div style="text-align:justify;"></div><div style="text-align:justify;">At this point, the attack is successful.</div><div style="text-align:justify;"> </div><div style="text-align:justify;"><strong>Verification</strong></div><div style="text-align:justify;"> </div><div style="text-align:justify;">We built a WebLogic 10.3.6.0 environment with the vulnerability, then constructed malicious deserialized data, and sent it to the target server through IIOP. When the target server parses the deserialized data, it triggered the execution of malicious code on opened the calculator app:</div><div style="text-align:justify;"> </div><div style="text-align:justify;"> </div><div style="text-align:justify;"><strong>Impact</strong></div><div style="text-align:justify;"> </div><div style="text-align:justify;">Affected Versions:</div><div style="text-align:justify;">WebLogic Server 10.3.6.0.0</div><div style="text-align:justify;">WebLogic Server 12.1.3.0.0</div><div style="text-align:justify;">WebLogic Server 12.2.1.3.0</div><div style="text-align:justify;">WebLogic Server 12.2.1.4.0</div><br /><div style="text-align:justify;"><strong>TimeLine</strong></div><div style="text-align:justify;"><div style="text-align:justify;"> </div><div style="text-align:justify;">• Jan 15, 2020 Oracle released a critical key patch fixing remote code execution vulnerability CVE-2020-2551.</div><br /><div style="text-align:justify;"> </div><div style="text-align:justify;">• Jan 15, 2020 Sangfor Far Sight Labs released an advisory alert for this vulnerability.</div><br /><div style="text-align:justify;"> </div><div style="text-align:justify;">• Mar 13, 2020 Sangfor Far Sight Labs reproduced the vulnerability and released technical analysis and solution recommendations.</div><br /><div style="text-align:justify;"><strong>Solution</strong></div><div style="text-align:justify;"> </div><div style="text-align:justify;"><strong>Remediation Solution</strong></div><div style="text-align:justify;">1. Oracle has released an official patch for fixing this vulnerability. Please refer to <a href="https://www.oracle.com/security-alerts/cpujan2020.html&quot; rel="noopener noreferrer" target="_blank"><span style="text-decoration: underline; color: #337fe5;">https://www.oracle.com/security-alerts/cpujan2020.html</span></a></div>… style="text-align:justify;"> </div><div style="text-align:justify;">2. The exploitation of the vulnerability can be temporarily be mitigated by closing the IIOP. To close IIOP perform the following:</div><br /><div style="text-align:justify;">• In the WebLogic console, select " Services " > "AdminServer" > " Protocol " and uncheck " Enable IIOP".</div><br /><div style="text-align:justify;">• Restart the WebLogic project to apply the configuration.</div><div style="text-align:justify;"> </div><div style="text-align:justify;"> </div><div style="text-align:justify;"><strong>Sangfor Products Mitigation Solution</strong></div><div style="text-align:justify;"> </div><div style="text-align:justify;">• For <span>Sangfor NGAF</span> customers, make sure that the NGAF security protection rules up to date.</div><br /><div style="text-align:justify;">• <span>Sangfor Cloud</span> WAF automatically updates its threat database immediately. Users are automatically protected from new high risk vulnerabilities.</div><br /><div style="text-align:justify;">• <span>Sangfor Cyber Command</span> is capable of detecting attacks exploiting this vulnerability and alerting users. Users can correlate Cyber Command to Sangfor NGAF to block attacker IP address.</div><br /><div style="text-align:justify;">• Sangfor SOC has Sangfor security consultants available 24*7 to help you with any security issues. Sangfor’s security experts will scan customer network environments regularly to ensure that the customer's server is free from this vulnerability. For users that have this vulnerability, our team will review and update device policies to ensure protection against this vulnerability.</div></div></div>