WebLogic Console Path Traversal RCE
- Product
- Oracle WebLogic Server
- CVE
- CVE-2020-14882CVE-2020-14750
- Disclosed
- 2020-10-20
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
- Fixed
- October 2020 CPU + Security Alert CVE-2020-14750 (2020-11-01)
Summary
A double-URL-encoded '../' in a static-resource path lets unauthenticated users reach the WebLogic admin console, and a console handle parameter instantiates arbitrary classes. Exploitation began within a week of the October 2020 CPU, and Oracle issued an emergency alert for a patch bypass.
Root cause
/console/css/%252e%252e%252fconsole.portal is permitted as a static resource but resolves to console.portal after double decoding (CVE-2020-14882). The portal's 'handle' parameter is used to construct a class by name with a String argument (CVE-2020-14883), so com.tangosol.coherence.mvel2.sh.ShellSession or Spring's FileSystemXmlApplicationContext run attacker code.
Impact
Unauthenticated RCE on WebLogic admin servers exposing the console.
Public PoC
http://target:7001/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession("java.lang.Runtime.getRuntime().exec('touch%20/tmp/success1');")Source: vulhub / weblogic/CVE-2020-14882
Detection
Search logs for '%252e%252e' or 'console.portal' with 'handle=' containing ShellSession or XmlApplicationContext. nuclei template CVE-2020-14882.
Mitigation
Apply the Oct 2020 CPU and the CVE-2020-14750 alert patch; do not expose port 7001/console to the internet.