CVE-2022-21371: Oracle WebLogic Server Auth Bypass Flaw

CVE-2022-21371 Overview

CVE-2022-21371 is a Local File Inclusion (LFI) vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware, specifically within the Web Container component. This vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server and gain unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.

Critical Impact
Unauthenticated attackers can exploit this vulnerability remotely via HTTP to access sensitive files and critical data on affected Oracle WebLogic Server installations without requiring any user interaction.

Affected Products

Oracle WebLogic Server 12.1.3.0.0
Oracle WebLogic Server 12.2.1.3.0
Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0

Discovery Timeline

2022-01-19 - CVE-2022-21371 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-21371

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Path Traversal), which manifests as a Local File Inclusion (LFI) weakness in the Web Container component of Oracle WebLogic Server. The vulnerability is easily exploitable and requires no authentication or user interaction, making it particularly dangerous for internet-facing WebLogic deployments.

The flaw allows attackers to manipulate file path parameters to traverse directories and access files outside the intended web application directory. This can lead to disclosure of sensitive configuration files, credentials, application source code, and other critical data stored on the server.

Root Cause

The root cause of CVE-2022-21371 lies in improper input validation within the Web Container component of Oracle WebLogic Server. The application fails to adequately sanitize user-supplied input used in file path operations, allowing attackers to inject path traversal sequences (such as ../) to navigate the file system hierarchy and access arbitrary files that the WebLogic process has read permissions for.

Attack Vector

The attack vector is network-based via HTTP, requiring no authentication or privileges. An attacker can craft malicious HTTP requests containing path traversal sequences to exploit the vulnerability. The attack has low complexity and requires no user interaction, making it suitable for automated exploitation.

Successful exploitation results in unauthorized read access to files on the WebLogic Server. This could include:

Configuration files containing database credentials
Application properties and secrets
System files accessible to the WebLogic process
Source code and sensitive business logic

The vulnerability mechanism involves sending specially crafted HTTP requests to the WebLogic Server that include directory traversal sequences. When the server processes these requests without proper validation, it follows the malicious path and returns the contents of files outside the intended web root directory. Technical details and proof-of-concept information are available in the Packet Storm security advisory.

Detection Methods for CVE-2022-21371

Indicators of Compromise

HTTP requests containing path traversal sequences such as ../, ..%2f, %2e%2e/, or %2e%2e%2f targeting WebLogic endpoints
Unusual access patterns to sensitive files like /etc/passwd, configuration files, or WebLogic-specific files
Web server logs showing requests with encoded directory traversal attempts
Access to files outside the normal web application directory structure

Detection Strategies

Deploy Web Application Firewall (WAF) rules to detect and block path traversal patterns in HTTP requests
Implement intrusion detection signatures for known WebLogic LFI exploitation attempts
Monitor WebLogic access logs for suspicious path traversal sequences and unusual file access patterns
Use endpoint detection tools to identify unauthorized file read operations by the WebLogic process

Monitoring Recommendations

Enable verbose logging on WebLogic Server to capture full request URIs and parameters
Configure SIEM alerts for HTTP requests containing encoded path traversal characters targeting WebLogic ports
Monitor file access patterns on the WebLogic server for reads of sensitive system or configuration files
Implement network traffic analysis to detect LFI exploitation attempts in real-time

How to Mitigate CVE-2022-21371

Immediate Actions Required

Apply the Oracle Critical Patch Update from January 2022 immediately to all affected WebLogic Server installations
Restrict network access to WebLogic Server administrative interfaces and limit exposure to trusted networks only
Implement WAF rules to block requests containing path traversal sequences as a temporary mitigation
Audit WebLogic Server configurations and remove unnecessary file read permissions from the application context

Patch Information

Oracle has addressed this vulnerability in the January 2022 Critical Patch Update (CPU). Administrators should apply the appropriate patches for their WebLogic Server version as documented in the Oracle Security Alert January 2022. The patch resolves the improper input validation issue in the Web Container component.

Workarounds

Deploy a reverse proxy or WAF in front of WebLogic Server to filter malicious requests containing path traversal patterns
Implement strict input validation at the application level to reject requests with directory traversal sequences
Restrict file system permissions for the WebLogic Server process to minimize the impact of potential exploitation
Consider network segmentation to limit attacker access to internal WebLogic deployments

bash

# Example WAF rule to block path traversal attempts (ModSecurity syntax)
SecRule REQUEST_URI "@rx \.\./" "id:1001,phase:1,deny,status:403,log,msg:'Path Traversal Attempt Blocked'"
SecRule REQUEST_URI "@rx %2e%2e%2f" "id:1002,phase:1,deny,status:403,log,msg:'Encoded Path Traversal Blocked'"
SecRule REQUEST_URI "@rx %2e%2e/" "id:1003,phase:1,deny,status:403,log,msg:'Partially Encoded Path Traversal Blocked'"