CVE-2020-14756: Oracle Coherence RCE Vulnerability

CVE-2020-14756 Overview

CVE-2020-14756 is a critical insecure deserialization vulnerability affecting Oracle Coherence, a key component of Oracle Fusion Middleware. This vulnerability exists in the Core Components of Oracle Coherence and allows an unauthenticated attacker with network access via IIOP (Internet Inter-ORB Protocol) or T3 protocols to completely compromise affected Oracle Coherence instances. The easily exploitable nature of this vulnerability combined with its ability to achieve full system takeover makes it an extremely high-priority security concern for organizations running vulnerable versions.

Critical Impact

Successful exploitation allows complete takeover of Oracle Coherence with full confidentiality, integrity, and availability impact. Unauthenticated attackers can remotely execute arbitrary code via IIOP or T3 protocols.

Affected Products

• Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0
• Oracle Utilities Framework versions 4.2.0.2.0, 4.2.0.3.0, 4.4.0.0.0, 4.4.0.2.0, and 4.4.0.3.0
• Oracle Fusion Middleware deployments utilizing affected Coherence components

Discovery Timeline

• January 20, 2021 - CVE-2020-14756 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2020-14756

Vulnerability Analysis

CVE-2020-14756 represents a severe security flaw in the way Oracle Coherence handles serialized objects received through network protocols. Oracle Coherence is an in-memory data grid solution widely used in enterprise environments for distributed caching and data management. The vulnerability resides in the Core Components where improper handling of serialized data allows attackers to inject malicious objects that execute arbitrary code upon deserialization.

The attack requires no authentication and can be performed by any attacker with network access to the IIOP or T3 protocol ports. When a malicious serialized object is sent to the vulnerable service, it is processed without adequate validation, triggering code execution with the privileges of the Oracle Coherence process. This can lead to complete system compromise, including access to sensitive data, modification of application logic, and denial of service.

Root Cause

The vulnerability stems from insecure deserialization practices within Oracle Coherence's Core Components. The application fails to properly validate or restrict the types of objects that can be deserialized when processing incoming network requests via IIOP or T3 protocols. This allows attackers to craft malicious serialized Java objects that, when deserialized by the server, execute attacker-controlled code. The lack of input validation on serialized data streams creates a direct pathway from network input to code execution.

Attack Vector

The attack vector leverages network access to Oracle Coherence services exposed via IIOP or T3 protocols. An attacker identifies a vulnerable Oracle Coherence instance accessible over the network, then constructs a malicious serialized Java object payload designed to execute arbitrary commands upon deserialization. The payload is transmitted to the target service through the IIOP or T3 protocol. Upon receipt, Oracle Coherence deserializes the object, triggering the execution of the malicious payload without any authentication requirements.

The attack mechanism follows the classic Java deserialization exploitation pattern where gadget chains within the application's classpath are leveraged to achieve code execution. Due to Oracle Coherence's enterprise deployment model, successful exploitation often grants attackers access to critical business data and internal network resources.

Detection Methods for CVE-2020-14756

Indicators of Compromise

• Unexpected network connections to IIOP (typically port 535) or T3 (typically port 7001) services from untrusted sources
• Abnormal process spawning or command execution originating from the Oracle Coherence or WebLogic Server process
• Unusual serialized Java object traffic patterns in network logs targeting Coherence endpoints
• Java deserialization exception logs indicating malformed or malicious object processing attempts

Detection Strategies

• Deploy network intrusion detection systems (NIDS) with signatures for known Java deserialization exploit payloads targeting T3 and IIOP protocols
• Implement application-level logging to capture and alert on deserialization errors or exceptions in Oracle Coherence components
• Monitor for anomalous outbound network connections from Coherence server processes that may indicate post-exploitation activity
• Utilize endpoint detection and response (EDR) solutions to identify suspicious child process creation from Java application servers

Monitoring Recommendations

• Enable verbose logging for Oracle Coherence and WebLogic Server to capture detailed connection and request information
• Implement network flow analysis to baseline normal T3 and IIOP traffic patterns and alert on deviations
• Deploy SentinelOne agents on systems hosting Oracle Coherence to detect and prevent exploitation attempts in real-time
• Regularly review access logs for authentication bypass attempts and unauthorized access to Coherence management interfaces

How to Mitigate CVE-2020-14756

Immediate Actions Required

• Apply Oracle's Critical Patch Update (CPU) from January 2021 immediately to all affected Oracle Coherence installations
• Restrict network access to IIOP and T3 protocol ports using firewalls to limit exposure to trusted networks only
• Implement network segmentation to isolate Oracle Coherence servers from untrusted network segments
• Review and audit all Oracle Coherence deployments to identify vulnerable versions requiring patching

Patch Information

Oracle has released security patches addressing CVE-2020-14756 in the January 2021 Critical Patch Update (CPU). Organizations should reference the Oracle Security Alert January 2021 for detailed patching instructions and download links. Additional updates were provided in the Oracle Security Alert January 2022. Apply the latest available patches for Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, and 14.1.1.0.0. For Oracle Utilities Framework, ensure all affected versions are updated according to Oracle's guidance.

Workarounds

• Disable IIOP and T3 protocol access if not required for business operations to eliminate the attack surface
• Implement network-level filtering to block incoming connections to T3 (port 7001) and IIOP (port 535) from untrusted sources
• Deploy a Web Application Firewall (WAF) or reverse proxy with rules to inspect and filter malicious serialized object payloads
• Configure Java deserialization filters using JEP 290 (if supported) to restrict deserializable classes

# Firewall configuration to restrict T3 and IIOP access
# Block T3 protocol (default port 7001) from external networks
iptables -A INPUT -p tcp --dport 7001 -s 0.0.0.0/0 -j DROP
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/8 -j ACCEPT

# Block IIOP protocol (default port 535) from external networks
iptables -A INPUT -p tcp --dport 535 -s 0.0.0.0/0 -j DROP
iptables -A INPUT -p tcp --dport 535 -s 10.0.0.0/8 -j ACCEPT