Exploit for CVE-2021-2302

githubexploit · 2021-09-16

Description

Exploit for Vulnerability in Oracle Platform Security For Java CVE-2021-2302. Gadget chain leads to RCE in Oracle Weblogic, Oracle BI, and Oracle Database 19c

Affected Oracle Platform Security For Java versions

Oracle Platform Security For Java= 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0

All known vulnerabilities by product

Opss Oracle Fusion Middleware Oracle Platform Security For Java

CVSS 9.8 for CVE-2021-2302

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Working code

96%confidence this exploit runs

Based on 2 file(s) in the source

EPSS Score

5.7%higher than 92.0% of all CVEs

Updated 2026-06-16

CVE Information

CVE-2021-2302

Exploit Details

Modified:2025-01-03 19:16

Last Seen:2025-08-31 20:58

Reporter:quynhle7821

Written in:Java

Last commit:2021-09-16

Repository:Archived

Other exploits for CVE-2021-2302

CVE-2021-2302

2026-08-27 KitPloitKITPLOIT

Exploit Code

README23 lines

## https://sploitus.com/exploit?id=F5E8481E-66F6-56CB-9978-EB66D506B26F
# CVE-2021-2302

Author: quynhle

Gadget chain
 
    javax.management.BadAttributeValueExpException.readObject()
      oracle.security.jps.az.internal.common.principals.toString()
	    oracle.security.jps.az.internal.common.principals.getResolvedPrincipal()
	         . . . con.newInstance() . . .
	      com.tangosol.coherence.mvel2.sh.ShellSession()
	      com.tangosol.coherence.mvel2.sh.ShellSession.exec()
	              . . . MVEL expression . . .
      --->   RCE
      
# Lab Environment
- Orace Weblogic Server: 12.1.2.3
- Oracle Business Intelligence: 12.1.2.4
- Oracle Database 19c

# PoC
![gif](https://user-images.githubusercontent.com/34308443/133580416-7373d471-98c9-44a6-b8a5-2248a14e1209.gif)

Exploit Code

Share

Share on social media: