CVE-2021-2135: Oracle WebLogic Server RCE Vulnerability

CVE-2021-2135 Overview

CVE-2021-2135 is a critical insecure deserialization vulnerability affecting the Coherence Container component of Oracle WebLogic Server. This vulnerability allows unauthenticated attackers with network access via T3 or IIOP protocols to execute arbitrary code and completely compromise vulnerable Oracle WebLogic Server instances. The flaw is easily exploitable and requires no user interaction or prior authentication, making it particularly dangerous in enterprise environments where WebLogic servers are often exposed to internal networks.

Critical Impact

Successful exploitation results in complete takeover of Oracle WebLogic Server, with full compromise of confidentiality, integrity, and availability of the affected system.

Affected Products

• Oracle WebLogic Server 12.2.1.3.0
• Oracle WebLogic Server 12.2.1.4.0
• Oracle WebLogic Server 14.1.1.0.0

Discovery Timeline

• April 22, 2021 - CVE-2021-2135 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-2135

Vulnerability Analysis

This vulnerability resides in the Coherence Container component of Oracle WebLogic Server, a distributed caching solution used for scalability and performance optimization in enterprise applications. The flaw enables remote code execution through the T3 and IIOP protocols, which are native communication protocols used by WebLogic Server for remote method invocation and distributed computing.

The vulnerability affects the serialization mechanism within the Coherence Container, allowing attackers to send specially crafted serialized objects that are processed without proper validation. When these malicious objects are deserialized by the server, arbitrary code execution occurs in the context of the WebLogic Server process.

Root Cause

The root cause of CVE-2021-2135 is improper handling of deserialization within the Coherence Container component. The T3 and IIOP protocols accept serialized Java objects over the network, and insufficient validation of these objects before deserialization allows attackers to inject malicious payloads. This is a common pattern in Java-based middleware where object serialization is used for inter-process communication without adequate security controls.

Attack Vector

The attack vector leverages network-accessible T3 or IIOP protocol endpoints, which are typically exposed on ports 7001 (T3) and 7002 (IIOP) by default. An attacker can craft a malicious serialized Java object containing a gadget chain that executes arbitrary commands upon deserialization.

The attack sequence typically involves:

1. Identifying a vulnerable WebLogic Server instance with T3/IIOP ports accessible
2. Crafting a malicious serialized object using known gadget chains present in the Coherence libraries
3. Sending the payload to the target server via the T3 or IIOP protocol
4. The server deserializes the object, triggering the execution of the embedded payload
5. Arbitrary code executes with the privileges of the WebLogic Server process

Detection Methods for CVE-2021-2135

Indicators of Compromise

• Unexpected outbound network connections from WebLogic Server processes
• Unusual process spawning from Java processes associated with WebLogic Server
• Suspicious T3 or IIOP traffic patterns with unusually large payloads
• Anomalous serialized object patterns in network traffic to ports 7001/7002

Detection Strategies

• Monitor network traffic for T3 and IIOP protocol communications containing suspicious serialized object signatures
• Implement deep packet inspection rules to detect known WebLogic deserialization gadget chains
• Configure SIEM rules to alert on unusual process execution chains originating from WebLogic Server processes
• Deploy endpoint detection solutions to monitor for post-exploitation activities such as reverse shells or lateral movement

Monitoring Recommendations

• Enable detailed logging for T3 and IIOP protocol handlers in WebLogic Server
• Monitor WebLogic Server access logs for connections from unexpected IP addresses
• Implement network segmentation to limit exposure of T3/IIOP protocols to trusted networks only
• Configure alerting for WebLogic Server process anomalies including unusual CPU/memory usage patterns

How to Mitigate CVE-2021-2135

Immediate Actions Required

• Apply the Oracle Critical Patch Update (CPU) from April 2021 immediately to all affected WebLogic Server instances
• If patching is not immediately possible, disable T3 and IIOP protocols or restrict network access to these ports
• Implement network-level controls to block external access to WebLogic administrative ports
• Review firewall rules to ensure T3 (port 7001) and IIOP (port 7002) are not exposed to untrusted networks

Patch Information

Oracle has released security patches addressing this vulnerability as part of the Oracle Critical Patch Update - April 2021. Organizations should download and apply the appropriate patches for their WebLogic Server versions (12.2.1.3.0, 12.2.1.4.0, or 14.1.1.0.0) from Oracle's support portal.

Workarounds

• Configure WebLogic Server to disable T3 and IIOP protocol access from untrusted networks using connection filters
• Implement network segmentation to isolate WebLogic Server instances from direct internet access
• Use WebLogic's built-in filtering capabilities to restrict protocol access to specific IP addresses or network ranges
• Consider deploying a web application firewall (WAF) capable of inspecting T3/IIOP traffic patterns

# Example WebLogic connection filter configuration to restrict T3 protocol access
# Add to config.xml or configure via WebLogic Admin Console
# This restricts T3 protocol to trusted internal network only

# In WebLogic Admin Console:
# 1. Navigate to Domain > Security > Filter
# 2. Enable Connection Filter
# 3. Add rules to restrict T3/IIOP to trusted networks:
#    Allow: 10.0.0.0/8 * T3 T3S
#    Deny: * * T3 T3S