Attacks on Oracle WebLogic Servers Detected After Publication of PoC Code

guest · Jul 24, 2018

Attacks on Oracle WebLogic Servers Detected After Publication of PoC Code
July 24, 2018
https://www.bleepingcomputer.com/ne...rvers-detected-after-publication-of-poc-code/

Oracle WebLogic servers are under attack from hackers who are trying to take over vulnerable installations that have not received a recent patch for a critical vulnerability.

The vulnerability has received a "critical" level and a severity score of 9.8 out of 10 on the CVSv3 severity scale due to its consequences, remote exploitation factor, and ease of exploitation.
At least two groups exploiting this at scale
Security researchers from ISC SANS and Qihoo 360 Netlab are currently tracking two separate groups who appear to have automated the exploitation routine and are conducting these hacks at a large scale.

Server owners are advised to apply the Oracle July 2018 CPU updates as soon as possible, and especially the patches for CVE-2018-2893. Oracle WebLogic servers running versions 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3 are known to be vulnerable and will need the patch.
Click to expand...

guest · May 1, 2020

Oracle warns of attacks against recently patched WebLogic security bug
May 1, 2020
https://www.zdnet.com/article/oracl...ainst-recently-patched-weblogic-security-bug/

Enterprise software giant Oracle published an urgent security alert last night, urging companies that run WebLogic servers to install the latest patches the company released in mid-April.

Oracle says it received reports of attempts to exploit CVE-2020-2883, a vulnerability in its WebLogic enterprise product.
The CVE-2020-2883 vulnerability is a dangerous bug, which received a 9.8 score out of 10, on the CVSSv3 vulnerability severity scale.

Oracle says that no user authentication or interaction is needed to exploit this bug. This makes CVE-2020-2883 an ideal candidate for integration in automated web-based attack tools and botnet operations.
Oracle patched the bug during its quarterly security updates, released on April 14.
Click to expand...

Current exploitation attempts appear to have started after proof-of-concept code to exploit the CVE-2020-2283 bug was published on GitHub a day later.
Oracle said that exploitation attempts against other vulnerabilities patched last month were also reported but the company highlighted the WebLogic vulnerability in particular.
Click to expand...

guest · Oct 29, 2020

Easily exploitable RCE in Oracle WebLogic Server under attack (CVE-2020-14882)
October 29, 2020
https://www.helpnetsecurity.com/2020/10/29/cve-2020-14882/

A critical and easily exploitable remote code execution vulnerability (CVE-2020-14882) in Oracle WebLogic Server is being targeted by attackers, SANS ISC has warned.
About the vulnerability (CVE-2020-14882)
CVE-2020-14882 may allow unauthenticated attackers with network access via HTTP to achieve total compromise and takeover of vulnerable Oracle WebLogic Servers.

The vulnerability affects Oracle WebLogic Server versions 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0, and has been patched by Oracle last week.
Click to expand...

For now, the attackers are only probing to see whether the target systems are vulnerable, but that’s likely because the honeypots did not return the “correct” response.

“The exploit appears to be based on this blog post published in Vietnamese by ‘Jang’,” he added. (The researcher in question has previously flagged several flaws in Oracle’s offerings, though not this one.)
The PoC exploit was published yesterday, and it didn’t take long for attackers to take advantage of it. Admins are advised to patch vulnerable systems as soon as possible.
Click to expand...

guest · Nov 3, 2020

mood said: ↑

Easily exploitable RCE in Oracle WebLogic Server under attack (CVE-2020-14882) October 29, 2020
Click to expand...

Oracle publishes rare out-of-band security update for WebLogic servers
November 3, 2020
https://www.zdnet.com/article/oracl...of-band-security-update-for-weblogic-servers/

Oracle has published on Sunday a rare out-of-band security update to address an incomplete patch for a recently disclosed vulnerability in Oracle WebLogic servers that is currently being actively exploited in real-world attacks.

The new patch (tracked as CVE-2020-14750) adds additional fixes to a first bug (tracked as CVE-2020-14882), originally patched with Oracle's standard quarterly October 2020 security updates.
CVE-2020-14882 is a dangerous vulnerability that allows attackers to execute malicious code on an Oracle WebLogic server with elevated privileges before the server's authentication kicks in.

Since exploitation is trivial, proof-of-concept (PoC) exploit code was made public within days after the initial Oracle patch [1, 2, 3, 4, 5].
Click to expand...

According to Adam Boileau, Principal Security Consultant at Insomnia Sec, the original patch for CVE-2020-14882 could be bypassed if attackers changed the case of a single character in the standard POC exploit.
The recent attacks and the bypass of the original patch are what drove Oracle to issue a second set of patches on Sunday, in a rare out-of-band security update.
Click to expand...

guest · Nov 5, 2020

Critical bug actively used to deploy Cobalt Strike on Oracle servers
November 5, 2020
https://www.bleepingcomputer.com/ne...ed-to-deploy-cobalt-strike-on-oracle-servers/

Threat actors are actively exploiting Oracle WebLogic servers unpatched against CVE-2020-14882 to deploy Cobalt Strike beacons which allow for persistent remote access to compromised devices.

Cobalt Strike is a legitimate penetration testing tool also used by threat actors in post-exploitation tasks and to deploy so-called beacons that enable them to gain persistent remote access.
This later allows them to access the compromised servers to harvest data and to deploy second stage malware payloads.
Click to expand...

Incoming ransomware attacks
The CVE-2020-14882 remote code execution (RCE) flaw was patched by Oracle during last month's Critical Patch Update and it was used by attackers to scan for exposed WebLogic servers one week later.
This latest series of attacks targeting vulnerable WebLogic instances started over the weekend as SANS ISC Handler Renato Marinho revealed in an advisory.
Admins urged to patch ASAP
Given that both CVE-2020-14882 and CVE-2020-14750 can easily be exploited by unauthenticated attackers to take over vulnerable WebLogic servers, Oracle advises companies to immediately apply the security updates to block attacks.
Click to expand...

guest · Dec 1, 2020

Critical Oracle WebLogic flaw actively exploited by DarkIRC malware
December 1, 2020
https://www.bleepingcomputer.com/ne...c-flaw-actively-exploited-by-darkirc-malware/

A botnet known as DarkIRC is actively targeting thousands of exposed Oracle WebLogic servers in attacks designed to exploit the CVE-2020-14882 remote code execution (RCE) vulnerability fixed by Oracle two months ago.

Almost 3,000 Oracle WebLogic servers are reachable over the Internet based on Shodan stats and allow unauthenticated attackers to execute remote code on targeted servers according to a Juniper Threat Labs report.
The threat actor selling the DarkIRC botnet on Hack Forums goes by the name of Freak_OG and started advertising it beginning with August 2020.

"We are not certain if the bot operator who attacked our honeypot is the same person who is advertising this malware in Hack Forums or one of his/her customers," the report reads.
Click to expand...

Infostealer and DDoS bot
DarkIRC is delivered on unpatched servers using a PowerShell script executed via an HTTP GET request in the form of a malicious binary that comes with both anti-analysis and anti-sandbox capabilities.
Click to expand...

guest · Aug 5, 2021

‘Prophet Spider’ Now Targeting Old Oracle WebLogic RCE Vulnerabilities
August 5, 2021
https://www.technadu.com/prophet-sp...d-oracle-weblogic-rce-vulnerabilities/293456/

Hacking group ‘Prophet Spider’ is exploiting last year’s WebLogic RCEs to gain access to corporate networks.

The actors then sell this access to other adversaries, mostly ransomware operators.

The initial access market has been on the rise for quite some time now, having exploded in 2021.

Click to expand...

‘Prophet Spider’, a sophisticated actor that has been around since at least May 2017, is now exploiting CVE-2020-14882 and CVE-2020-14750, two remote code execution (RCE) flaws on Oracle WebLogic. As detailed in a report by Crowdstrike, the actors are mostly interested in gaining access to the target’s environment and then selling that access to other groups of hackers, like ransomware actors for example. In its recent campaign, ‘Prophet Spider’ demonstrates expertise in targeting both Linux and Windows operating systems, which gives them versatility and potential.

While the scenario of ‘Prophet Spider’ deploying ransomware payloads themselves cannot be ruled out with absolute certainty, CrowdStrike Intelligence believes they are most probably functioning as access brokers. This is supported by the fact that in at least two recorded infection incidents, the ransomware strains used were different (Egregor and MountLocker), so ‘Prophet Spider’ must have sold access to these groups.
Click to expand...

Log in or Sign up

Attacks on Oracle WebLogic Servers Detected After Publication of PoC Code

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Attacks on Oracle WebLogic Servers Detected After Publication of PoC Code

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches