Remote Code Execution Vulnerability found in Oracle Weblogic (again)
|by Alpha Team
On 18 June 2019, Oracle released a security advisory detailing a vulnerability in their WebLogic software. The vulnerability resides in WebLogic's XMLDecoder deserialization logic. A specialized packet can be sent to WebLogic to trigger this vulnerability which can result in remote code execution with no authentication reqiured. The CVSS score is 9.8 out of 10.
Recommendations
- Apply the patches for CVE-2019-2729
- Consider enabling Cyber Attack Chatter in the platform to monitor chatter related to this vulnerability
Details
A blog post by Oracle outlined that this vulnerability is a distinct vulnerability from another deserialization bug released earlier this year, CVE-2019-2725. Oracle released the patch for CVE-2019-2729 out of band and not on their regular patch schedule. This could point to evidence of the vulnerability being exploited in the wild, which was exactly what happened with CVE-2019-2725, where attackers were using it to drop the Sodinokibi ransomware family.
Tags: all industries, global, vulnerability/exploit