WebLogic wls9_async XMLDecoder Deserialization
- Product
- Oracle WebLogic Server
- CVE
- CVE-2019-2725
- Disclosed
- 2019-04-26
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- 10.3.6.0.0, 12.1.3.0.0
- Fixed
- Oracle Security Alert CVE-2019-2725 patch
Summary
A 0-day in WebLogic's async SOAP components (wls9_async_response, wls-wsat) allowed unauthenticated deserialization via XMLDecoder. It was used to deploy Sodinokibi/REvil ransomware and cryptominers before and after Oracle's emergency alert.
Root cause
The WorkContext SOAP header handler parsed attacker-controlled XML with java.beans.XMLDecoder. Oracle's earlier blacklist (for CVE-2017-10271) was bypassed using <class> elements and classes like UnitOfWorkChangeSet that wrap a second deserialization.
Impact
Unauthenticated RCE on exposed WebLogic servers.
Detection
Look for POSTs to /_async/AsyncResponseService or /wls-wsat/* containing <work:WorkContext> with <class> or <void> elements. nuclei template CVE-2019-2725.
Mitigation
Apply the security alert patch, or remove/disable wls9_async_response.war and wls-wsat.war and block /_async/* and /wls-wsat/*.