August Vulnerability of the Month: Critical Vulnerability in Oracle WebLogic Targeted by Attackers

Tenable Research

In August, Tenable Research voted to highlight CVE-2018-2893 in Oracle WebLogic Server because it was almost immediately exploited by multiple threat actors.

Novelty, sophistication or just plain weirdness are some of the potential criteria we use to select the Tenable vulnerability of the month. We collect nominations from our 70+ research team members, shortlist the finalists and give the entire team the chance to vote – combining the total experience and knowledge of Tenable Research to identify the vulnerability of the month.

Background

CVE-2018-2893 caught our researchers’ attention this month. It allows for remote, unauthenticated attacks and received a CVSSv3 score of 9.8. While the vulnerability was patched in the Oracle Critical Patch Update on July 17, researchers saw exploitation in the wild of this vulnerability as early as July 21. Two separate groups were seen exploiting this vulnerability in large-scale attacks in the days following disclosure, likely fueled by publication of multiple proofs of compromise.

What makes this the vulnerability of the month?

The quick turnaround between disclosure of the vulnerability and exploitation in the wild is worth noting. While it may take months for some vulnerabilities to have a public exploit, some are valuable enough to warrant almost immediate exploitation. Our recent report, Quantifying the Attacker’s First-Mover Advantage, found that 34% of the most prevalent vulnerabilities had an exploit available on the same day they were disclosed publicly.

Vulnerabilities in WebLogic servers have become quite common (there have been nine disclosed so far in 2018, with CVSSv2 scores ranging from 5.8–7.5), and threat actors have been increasingly targeting them in the last year, particularly for mining cryptocurrency. While Oracle has been releasing patches to address these vulnerabilities as they are discovered and disclosed, more than once researchers have found ways to bypass the fixes, further complicating the issue. CVE-2018-2893 continues a vulnerability trend that shows no sign of changing.

The value of cryptomining is a strong motivator for criminals to target these vulnerabilities. In addition to cryptomining, Oracle WebLogic servers are frequently connected to systems containing sensitive data, such as intellectual property or personally identifiable information (PII), which could be tempting targets for attackers.

Vulnerability details

A recently patched flaw discovered in the WebLogic Server Core Components subcomponent of Oracle Weblogic allows a remote, unauthenticated attacker to take complete control over a host. The vulnerability is caused by unsafe deserialization of Java objects, an attack vector that’s been in the news several times in recent years. Using a crafted request over the T3 protocol, an attacker can execute arbitrary code on an affected WebLogic server, leading up to full control over that host. Reports have surfaced on social media suggesting there are ways to bypass the patch and continue to exploit a vulnerable host. However, this is yet to be confirmed by Oracle.

Additional information

Learn more about Tenable.io, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.

Read more >

Published on Aug 30, 2018

People also viewed

Technical Support Engineer

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Technical Support Technical Support
Your Role:Tenable is looking for motivated individuals to join our Technical Support Team. The Technical Support Engineer (TSE) is the first contact for all customers when they require technical assistance.  In a time when the next Spectre and Mel...

Sales Development Representative

Singapore Singapore Singapore North Bridge Road, Parkview Square, Singapore, 188788 Lead Generation Sales
Your Role:The Sales Development Representative supports remote sales teams in and is responsible for generating new business via inbound and outbound phone opportunity qualification. Your Opportunity: Perform outbound calling to generate new sales...

Customer Success Manager - APAC Nessus

Singapore Singapore Singapore North Bridge Road, Parkview Square, Singapore, 188788 Customer Success Sales
Your Role:Tenable has an immediate need for a Customer Success Manager who will be responsible for establishing and driving sales activities for our software products within a designated geography. You will be expected to penetrate and prospect na...

Commercial Sales Engineer - Mexico

Mexico City Mexico Mexico Presidenta Masarik, Polanco V Seccion, Mexico City, Mexico, 21045 Sales Engineering Sales
Your Role:Tenable is seeking a Commercial Sales Engineer to assist and drive Business and Technical aspects of strategic selling in your assigned region. You will be partnering with Territory Managers and a strong team of peers to: differentiate t...

Director of Engineering - Shared Services Infrastructure

Columbia Maryland United States Columbia Gateway Drive, Columbia, Maryland, United States, 21046 Sensors Engineering
Your Role:Tenable is looking for a talented and energetic Director of Software Engineering to lead the Shared Services Infrastructure (SSI) development team. The SSI team helps organizations address key challenges of traditional vulnerability scan...

Principal UX Designer

San Jose California United States E Santa Clara St., San Jose, California, United States, 95113 Cloud Platforms Engineering
Your Role:Tenable is looking for an extraordinary Principal UX Designer to join our team. Our group is chartered with creating the next generation of security products while at the same time pioneering unprecedented user experience in the digital ...

We have big plans for continued global growth, and we’re looking for people who are creative, flexible and dedicated to helping us build something great – something that matters.