Oracle WebLogic WLS Security Component Remote Code Execution (CVE-2017-10271)

In October 2017 Oracle have published a vulnerability concerning Oracle WebLogic and assigned CVE-2017-10271 to it. Since then no public information regarding this vulnerability was available until a few days ago, when an analysis of the vulnerability and a Proof-of-Concept exploit were published.

The vulnerability stems from an unsafe XML deserialization using Java XMLDecoder in the CoordinatorPortType web service, which is part of the WLS Security component of WebLogic.

Attackers may send a crafted XML document to the aforementioned web service which will cause WebLogic to deserialize it and consequently allow an attacker to construct arbitrary Java objects and invoke their methods resulting in remote code execution.

Figure 1: Part of the request exploiting the vulnerability.

Mitigating the vulnerability with BIG-IP ASM

BIG-IP ASM customers under any supported BIG-IP version are already protected against this 0-day vulnerability, as the exploitation attempt will be detected by an existing Java code injection attack signature (200004174) which can be found in signature sets that include “Server Side Code Injection” attack type or “Java Servlets/JSP” System.

Figure 2: Exploitation attempt blocked by signature id 200004174.

We will be also releasing a dedicated signature in the upcoming ASM Security Update.