August Vulnerability of the Month: Critical Vulnerability in Oracle WebLogic Targeted by Attackers

Tenable Research

In August, Tenable Research voted to highlight CVE-2018-2893 in Oracle WebLogic Server because it was almost immediately exploited by multiple threat actors.

Novelty, sophistication or just plain weirdness are some of the potential criteria we use to select the Tenable vulnerability of the month. We collect nominations from our 70+ research team members, shortlist the finalists and give the entire team the chance to vote – combining the total experience and knowledge of Tenable Research to identify the vulnerability of the month.

Background

CVE-2018-2893 caught our researchers’ attention this month. It allows for remote, unauthenticated attacks and received a CVSSv3 score of 9.8. While the vulnerability was patched in the Oracle Critical Patch Update on July 17, researchers saw exploitation in the wild of this vulnerability as early as July 21. Two separate groups were seen exploiting this vulnerability in large-scale attacks in the days following disclosure, likely fueled by publication of multiple proofs of compromise.

What makes this the vulnerability of the month?

The quick turnaround between disclosure of the vulnerability and exploitation in the wild is worth noting. While it may take months for some vulnerabilities to have a public exploit, some are valuable enough to warrant almost immediate exploitation. Our recent report, Quantifying the Attacker’s First-Mover Advantage, found that 34% of the most prevalent vulnerabilities had an exploit available on the same day they were disclosed publicly.

Vulnerabilities in WebLogic servers have become quite common (there have been nine disclosed so far in 2018, with CVSSv2 scores ranging from 5.8–7.5), and threat actors have been increasingly targeting them in the last year, particularly for mining cryptocurrency. While Oracle has been releasing patches to address these vulnerabilities as they are discovered and disclosed, more than once researchers have found ways to bypass the fixes, further complicating the issue. CVE-2018-2893 continues a vulnerability trend that shows no sign of changing.

The value of cryptomining is a strong motivator for criminals to target these vulnerabilities. In addition to cryptomining, Oracle WebLogic servers are frequently connected to systems containing sensitive data, such as intellectual property or personally identifiable information (PII), which could be tempting targets for attackers.

Vulnerability details

A recently patched flaw discovered in the WebLogic Server Core Components subcomponent of Oracle Weblogic allows a remote, unauthenticated attacker to take complete control over a host. The vulnerability is caused by unsafe deserialization of Java objects, an attack vector that’s been in the news several times in recent years. Using a crafted request over the T3 protocol, an attacker can execute arbitrary code on an affected WebLogic server, leading up to full control over that host. Reports have surfaced on social media suggesting there are ways to bypass the patch and continue to exploit a vulnerable host. However, this is yet to be confirmed by Oracle.

Additional information

Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

Read more >

Published on Aug 30, 2018

People also viewed

Channel Sales Engineer

Santiago Santiago Chile Santiago, Chile Sales Engineering Sales
Your Role:The Channel Sales Engineer will support and will be working with production, engineering, and research and development, as well as external sales firms to determine how Tenable products and services could be designed or modified to best ...

Engineering Manager - UI

Los Angeles California United States West Jefferson Boulevard, Playa Vista, Los Angeles, California, United States, 90066 Cloud Platforms Research & Development
Your Role:Tenable is looking for an experienced UI Engineering manager, who would be responsible for leading a team of world class engineers.  This person would be expected to help grow and mentor experience engineers. Background in working with m...

Engineering Manager - UI

San Jose California United States E Santa Clara St., San Jose, California, United States, 95113 Cloud Platforms Research & Development
Your Role:Tenable is looking for an experienced UI Engineering manager, who would be responsible for leading a team of world class engineers.  This person would be expected to help grow and mentor experience engineers. Background in working with m...

Engineering Manager - UI

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 20146 Cloud Platforms Research & Development
Your Role:Tenable is looking for an experienced UI Engineering manager, who would be responsible for leading a team of world class engineers.  This person would be expected to help grow and mentor experience engineers. Background in working with m...

Commercial Territory Manager

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 20146 Sales Sales
Your Role:The Commercial Territory Manager will meet and exceed quarterly sales quota by developing new opportunities within specific geographical territory.  Researching and identifying potential accounts; outbound cold calling to soliciting new ...

Recruiter - UK

Uxbridge United Kingdom Furzeground Way , Stockley Park, Uxbridge, United Kingdom, UB11 1EZ Human Resources Human Resources
Your Role:Tenable is seeking a talented Recruiter who will source, screen and ultimately close exceptional sales, marketing and professional services talent. You’ll partner with Tenable’s Sales leadership to create and maintain a talent pipeline, ...

We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.