Oracle Weblogic Server Flaw Allows Attackers Full Control – PoC Released

A original secondary JNDI injection vulnerability was model in a recent version of WebLogic, permitting attackers to position of living off JNDI injection staunch by design of every other JNDI look up task, successfully enabling A ways flung Code Execution (RCE) on the targeted system.

A patch has been implemented for this vulnerability, which was no longer model in earlier versions of Oracle utility and was included within the reliable Oracle Q2 quarterly change.

An attacker can exploit WebLogic’s JNDI performance by design of two fundamental techniques. First, if the target class implements the OpaqueReference interface and WebLogic uses the ForeignOpaqueReference class, a malicious look up operation can set of living off JNDI injection by design of the getReferent design.

Second, by environment the java.naming.factory.object attribute to the MessageDestinationObjectFactory class staunch by design of InitialContext initialization, the getObjectInstance design turns into at risk of JNDI injection when a look up operation is performed.

It will get round customary restrictions on JNDI attributes, which lets any code bustle on the WebLogic server, and it seems at two original JNDI injection vulnerabilities, CVE-2024-20931 and CVE-2024-21006, within the context of the WebLogic server.

CVE-2024-20931 exploits the initialization of InitialContext, whereas CVE-2024-21006 introduces a malicious objectfactory staunch by design of this initialization and triggers upon look up. WebLogic’s look up operation calls techniques essentially based completely totally on the target class’s implemented interfaces.

Handiest by enforcing ClassTypeOpaqueReference and its linked techniques (getObjectClass/getReferent) or OpaqueReference (getReferent) can these vulnerabilities, in conjunction with CVE-2023-21839, CVE-2023-21931, and CVE-2024-20931, be exploited.

WebLogic patches for CVE-2023-21839 and CVE-2024-20931 cease unauthorized JNDI lookups. The repair modifies the `weblogic.jndi.inside of.ForeignOpaqueReference#getReferent` design. When `getReferent` is known as, `InitialContext` automatically sets the `java.naming.factory.preliminary` and `java.naming.supplier.url` properties.

It prevents the spend of the malicious `remoteJNDIName` rate contained within the `look up` call, successfully stopping some distance away JNDI exploitation by design of `ForeignOpaqueReference`. Furthermore, `weblogic.jndi.inside of.JNDIUtils#isValidJndiScheme` validates the JNDI plan to extra prohibit unauthorized entry.

Per pwnull, the code looks at risk of JNDI injection even supposing same old JNDI properties bask in “java.naming.factory.preliminary” are no longer set of living. The attacker can exploit the “java.naming.factory.object” attribute, which is recurrently venerable in more moderen JDK versions.

The exploit leverages the BeanFactory#getObjectInstance design in Tomcat to call  MessageDestinationObjectFactory#getObjectInstance in WebLogic, which within the demolish triggers JNDI injection by design of MessageDestinationReference#lookupMessageDestination.

WebLogic would per chance moreover prohibit how to configure JNDI lookups by controlling properties bask in `java.naming.factory.preliminary` and look up names. To circumvent these obstacles, `java.naming.factory.object` would per chance moreover moreover be venerable to position of living a customized object factory.

The factory implements the `getObjectInstance` design of `MessageDestinationObjectFactory` achieving secondary JNDI injection in WebLogic, permitting to circuitously adjust resource binding and potentially circumvent restrictions.