CVE-2023-21839

CVE-2023-21839 Analysis This vulnerability is caused by triggering the getReferent method of the bound object when calling the lookup or list method after binding an object via the t3 or iiop protocol. Call stack for t3 protocol: getObjectInstance:96, WLNamingManager weblogic.jndi.internal...

CVE-2024-21006_PoC

CVE-2024-21006 PoC CVE-2024-21006 is a critical Remote Code Execution RCE vulnerability affecting Oracle WebLogic Server. The flaw is related to the insecure use of the IIOP Internet Inter-ORB Protocol and JNDI Java Naming and Directory Interface protocols, allowing an unauthenticated remote...

CVE-2020-14756

CVE-2020-14756 WebLogic T3/IIOP RCE ExternalizableHelper.class of coherence.jar README project base on https://github.com/Y4er/CVE-2020-2555 and weblogiccmd test on 12.2.1.4.0 and jdk 1.8.0221 Reference 1. https://y4er.com/post/weblogic-cve-2020-14756/ 2...

CVE-2023-21837

CVE-2023-21837 POC,EXP, chatGPT for me code import socket CVE-2023-21837 def checkvulnerabilitytargethost, targetport: create socket object s = socket.socketsocket.AFINET, socket.SOCKSTREAM set timeout to 30 seconds s.settimeout30 try: connect to target s.connecttargethost, targetport send exploi...

CVE-Exploit

Twitter: @0xAbbarhSF 1、CVE-2020-2551 CVE-2020-2551 poc exploit python example keys: GIOP corba How use python3 CVE-2020-2551.py -u http://192.168.26.79:7001 cat urls.txt|sort -u|xargs -I % python3 CVE-2020-2551.py -u % cat xxx.html|grep -Eo 'https?://^ /+'|sort -u|xargs -I % python3...

CVE-2020-2551

CVE-2020-2551 Weblogic IIOP Deserialization Test Environment Weblogic10.3.6+jdk1.6 Packaged jar file Extraction code: a6ob Exploit Download the jar package, then use marshalsec to start a malicious RMI service, compile a local exp.java package payload; import java.io.IOException; public class exp...

CVE-2021-2394

CVE-2021-2394 POC of CVE-2021-2394 Disclaimer This project is for educational use only. Any direct or indirect consequences and losses caused by unauthorized testing shall be borne solely by the user. Notes The POC uses IIOP to send packets. Please add the relevant dependencies the 12.2.1.3.0...

CVE-2020-2551

CVE-2020-2551 Weblogic RCE with IIOP 0x01 Default Enable IIOP 0x02 Poc Demo...

CVE-2020-2551

Twitter: @Hktalent3135773 0、how get pro exploit tools? see https://github.com/hktalent/CVE-2020-2551/issues/5 1、CVE-2020-2551 CVE-2020-2551 poc exploit python example keys: GIOP corba How use python3 CVE-2020-2551.py -u http://192.168.26.79:7001 cat urls.txt|sort -u|xargs -I % python3...

CVE-2024-21006

CVE-2024-21006 CVE-2024-21006 Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T...

Oracle WebLogic Server - Remote Code Execution

Oracle WebLogic Server 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 contains a remote code execution caused by unauthenticated access via T3, IIOP, letting attackers take over the server, exploit requires network access. id: CVE-2021-2135 info: name: Oracle WebLogic Server - Remote Code Execution author:...

CVE-2021-2394

CVE-2021-2394 POC of CVE-2021-2394 Disclaimer This project is for learning purposes only. Any direct or indirect consequences and losses caused by unauthorized testing shall be borne by the user. Notes The POC sends packets using IIOP. Please add relevant dependencies dependencies for version...

CVE-2023-21839-metasploit-scanner

CVE-2023-21839-metasploit-scanner Usage git clone https://github.com/kurehalin/CVE-2023-21839-metasploit-scanner cd CVE-2023-21839-metasploit-scanner mkdir -p /.msf4/modules/auxiliary/scanner/http cp weblogiciioprce.py /.msf4/modules/auxiliary/scanner/http chmod +x...

CVE-2024-21182

CVE-2024-21182 — Oracle WebLogic Server T3/IIOP JNDI Injection → RCE lab A self-contained, one-command Docker lab to reproduce and validate the Oracle WebLogic Server OpaqueReference JNDI-injection vulnerability family CVE-2024-21182, a patch bypass of CVE-2023-21839 and turn it into...

Oracle WebLogic Server - Remote Code Execution

Oracle WebLogic Server Oracle Fusion Middleware component: WLS Core Components is susceptible to a remote code execution vulnerability. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 2.2.1.3.0 and 12.2.1.4.0. This easily exploitable vulnerability could allow unauthenticated...

CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE

CVE-2024-21182 - Oracle WebLogic Server JNDI Injection → RCE CVE-2024-21182 - Oracle WebLogic Server JNDI Injection → RCE -orange 📋 Description CVE-2024-21182 is an unauthenticated JNDI injection vulnerability affecting the Core component of Oracle WebLogic Server. It allows a remote attacker, vi...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...

wildfly-iiop-openjdk: Missing authentication on EAP's IIOP NameService leads to MITM or DoS

A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations...

wildfly: wildfly-iiop: wildfly-jacorb: Wildfly: Pre-auth denial of service on the IIOP listener

A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size...

openjdk-orb: unauthed class loading via IIOP in EAP

when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run...