Background
CVE-2019-2725 is a deserialization vulnerability in Oracle WebLogic, a Java EE application server which allows users to build, develop and deploy internet facing enterprise applications. This vulnerability affected all versions that have the wls9_async_response.war and wls-wsat.war components enabled.
This CVE is easily exploitable by threat actors, enabling remote code execution without authentication nor user interaction. The fact that the applications hosted on WebLogic are internet facing allows threat actors with network access via HTTP to compromise vulnerable Oracle WebLogic servers. There are two Metasploit modules available for remote code execution by targeting port 7001. Due to the low complexity of the attack and its potential impact on a vulnerable organisation making it attractive to threat actors. Moreover, it affects all three components of the CIA triad – confidentiality, availability and integrity.
In the days prior to Oracle issuing the patch, there was a reported increase on WebLogic attack activity, with threat actors probing the vulnerable servers prior to launching attacks. Within this same week in April, proof-of-concept code for this CVE was also published on GitHub, making it readily available to any potential malicious actor. We also reported on this vulnerability being exploited to deploy Sodinokibi and GandCrab ransomware, demonstrating the vulnerability’s potential for facilitating rapid lateral movement for ransomware operators.. Furthermore, it has been exploited in Monero mining campaigns, infection of cloud servers by the Muhstik botnet, and for deploying Golang-based remote access trojans. Targeted organisations include organisations in the following sectors: telecommunications, technology, government, healthcare and manufacturing.Mitigation
Due to the severity of the vulnerability, we recommend organisations respect the following mitigation guidelines:
- Apply Oracle’s patch for the vulnerability
- Restrict traffic to vulnerable hosts to only trusted devices
This concludes our 12 vulns of Christmas blog series, which examined 12 high-severity CVEs, their past and present exploitation by threat actors, and mitigation advice for organisations with vulnerable hosts. Using OVS scores, Orpheus analysts have been able to prioritise threat intelligence reporting on these vulnerabilities. You can read the previous editions here: