A Vulnerability in Oracle WebLogic Could Allow for Remote Code Execution

ITS Advisory Number: 
2019-068
Date(s) Issued: 
Thursday, June 20, 2019
Subject: 
A Vulnerability in Oracle WebLogic Could Allow for Remote Code Execution
Overview: 

A vulnerability has been discovered in the Oracle WebLogic that could allow for remote code execution. Oracle WebLogic is an application server used for building and hosting Java-EE applications. Successful exploitation of this vulnerability could result in remote code execution within the context of the application. Depending on the privileges associated with the application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

 

THREAT INTELLIGENCE:

There are reports of this vulnerability being actively exploited in the wild.

Systems Affected: 
  • Oracle WebLogic versions 10.3.6.0.0, 12.1.3.0.0, and 12.2.1.3.0
RISK
GOVERNMENT
Large and medium government entities: 
High
Small government entities: 
High
BUSINESS
Large and medium business entities: 
High
Small business entities: 
High
Home Users: 
Low
Description: 

A vulnerability has been discovered in Oracle WebLogic that could allow for remote code execution. This vulnerability exists within the XMLDecoder component of WebLogic, which can allow for deserialization of malicious code. An unauthenticated attacker can exploit this issue by sending crafted requests to the affected application. Successful exploitation of this vulnerability could allow for remote code execution with elevated privileges.

Actions: 
  • Verify no unauthorized system modifications have occurred on system before applying patch.
  • After appropriate testing, immediately install the patch provided by Oracle.
  • Apply the Principle of Least Privilege to all systems and services. 
  • Monitor intrusion detection systems for any signs of anomalous activity.
  • Unless required, limit external network access to affected products.