admin/GobyVuls
1
0
Fork 0
mirror of https://github.com/gobysec/GobyVuls.git synced 2025-06-20 18:00:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

add Weblogic Secondary Deserialization RCE (CVE-2021-2135)

Browse Source
This commit is contained in:
gaopeng2 2021-07-25 16:07:12 +08:00
parent 0f021f5d79
commit e8865f7de9
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
WebLogic/CVE-2021-2135/README.md Normal file
View File

@ -0,0 +1,9 @@
# Weblogic Secondary Deserialization RCE (CVE-2021-2135)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
**FOFA query rule**: [app=\"BEA-WebLogic-Server\" || app=\"Weblogic_interface_7001"](https://fofa.so/result?qbase64=YXBwPSJCRUEtV2ViTG9naWMtU2VydmVyIiB8fCBhcHA9IldlYmxvZ2ljX2ludGVyZmFjZV83MDAxIg%3D%3D)
# Demo
![](Weblogic_T3_IIOP_RCE_CVE-2021-2135.gif)

BIN
WebLogic/CVE-2021-2135/Weblogic_T3_IIOP_RCE_CVE-2021-2135.gif Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.8 MiB