CIS Logo
tagline: Confidence in the Connected World

A Vulnerability in Oracle WebLogic Could Allow for Remote Code Execution

MS-ISAC ADVISORY NUMBER:

2019-048

DATE(S) ISSUED:

04/26/2019

OVERVIEW:

A vulnerability has been discovered in the Oracle WebLogic that could allow for remote code execution. Oracle WebLogic is an application server used for building and hosting Java-EE applications. Successful exploitation of this vulnerability could result in remote code execution within the context of the application. Depending on the privileges associated with the application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

THREAT INTELLIGENCE:

There are reports of this vulnerability being actively exploited in the wild in April 2019.

SYSTEMS AFFECTED:

  • All versions of Oracle WebLogic with WLS9_ASYNC and WLS-WSAT components enabled
  • Oracle WebLogic versions 10.3.6.0.0 and 12.1.3.0.0

RISK:

Government:
  • Large and medium government entities: HIGH
  • Small government entities: HIGH
Businesses:
  • Large and medium business entities: HIGH
  • Small business entities: HIGH
Home Users:
LOW

TECHNICAL SUMMARY:

A vulnerability has been discovered in Oracle WebLogic that could allow for remote code execution. This vulnerability exists within the WLS9_ASYNC and WLS-WSAT components of WebLogic, which can allow for deserialization of malicious code. An unauthenticated attacker can exploit this issue by sending crafted requests to the affected application. Successful exploitation of this vulnerability could allow for remote code execution with elevated privileges.

April 29 - UPDATED TECHNICAL SUMMARY
Oracle WebLogic has made patches available which mitigate CVE-2019-2725.

RECOMMENDATIONS:

We recommend the following actions be taken:

  • As a temporary workaround, consider disabling the WLS9_ASYNC and WLS-WSAT components until a patch is available.
  • When available, apply appropriate updates provided by Oracle to affected systems immediately after appropriate testing.
  • Apply the Principle of Least Privilege to all systems and services.
  • Verify no unauthorized system modifications have occurred on system before applying patch.
  • Monitor intrusion detection systems for any signs of anomalous activity.
  • Unless required, limit external network access to affected products.

APRIL 26 – UPDATED RECOMMENDATIONS:
Apply appropriate updates provided by Oracle to affected systems immediately, after appropriate testing.

REFERENCES:

Get Email Updates When Cyber Threats Like This Arise

Arrow Subscribe to Advisories

Related Resources



Arrow CIS Control 18: Application Software Security

Information Hub : Advisories


CONTROL: 1 --- ADVISORY CONTROL: 0
CONTROL: 2 --- ADVISORY CONTROL: 0
CONTROL: 3 --- ADVISORY CONTROL: 0

Pencil Blog post 18 Jul 2019
CONTROL: 4 --- ADVISORY CONTROL: 0