CVE-2023-21839: Oracle WebLogic Server Disclosure Flaw

CVE-2023-21839 Overview

CVE-2023-21839 is an unauthenticated deserialization vulnerability in Oracle WebLogic Server, a component of Oracle Fusion Middleware. The flaw resides in the Core component and is reachable over the T3 and Internet Inter-ORB Protocol (IIOP) network listeners. An unauthenticated remote attacker with network access to those listeners can abuse JNDI lookups to retrieve and process attacker-controlled remote objects, leading to disclosure of sensitive data and, in many environments, remote command execution. CISA added CVE-2023-21839 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. The Exploit Prediction Scoring System (EPSS) places this CVE in the top percentile of likely-to-be-exploited vulnerabilities.

Critical Impact
Unauthenticated attackers can reach Oracle WebLogic Server over T3/IIOP and trigger remote JNDI lookups, resulting in unauthorized access to all server-accessible data and frequent escalation to remote command execution.

Affected Products

Oracle WebLogic Server 12.2.1.3.0
Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0

Discovery Timeline

2023-01-18 - CVE-2023-21839 published to the National Vulnerability Database (NVD)
2023-01-17 - Oracle releases Critical Patch Update (CPU) addressing the vulnerability
2025-10-27 - Last updated in NVD database

Technical Details for CVE-2023-21839

Vulnerability Analysis

The vulnerability is a remote Java Naming and Directory Interface (JNDI) injection flaw in the Core component of Oracle WebLogic Server. WebLogic exposes the T3 and IIOP remote protocols for inter-server communication and remote management. The protocols accept serialized Java objects from clients without requiring authentication. An attacker can supply a bound object reference whose getReferent() call triggers a JNDI lookup against an attacker-controlled Lightweight Directory Access Protocol (LDAP) or Remote Method Invocation (RMI) endpoint. The server resolves the remote reference and instantiates the returned object inside the WebLogic Java Virtual Machine (JVM). CWE-502 (Deserialization of Untrusted Data) and CWE-306 (Missing Authentication for Critical Function) both apply.

Root Cause

The T3 and IIOP listeners process bound names and object references before any authentication check. The Core component performs lookup() operations on attacker-supplied JNDI URIs without restricting the protocol scheme or the remote host. This bypasses fixes applied to earlier WebLogic JNDI issues such as CVE-2020-2551 and CVE-2021-2109.

Attack Vector

An attacker sends a crafted T3 or IIOP request to the WebLogic listener, typically on TCP port 7001 or 7002. The payload contains a javax.naming.Reference or similar wrapper pointing to an external LDAP server controlled by the attacker. WebLogic resolves the reference, fetches the remote class definition or serialized payload, and processes it inside the server JVM. Public proof-of-concept code demonstrating pre-authentication remote command execution against vulnerable servers has been published, including a Packet Storm exploit report.

No verified exploit code is reproduced here. Refer to the linked advisory and Oracle's Critical Patch Update January 2023 for technical details.

Detection Methods for CVE-2023-21839

Indicators of Compromise

Outbound LDAP, LDAPS, or RMI connections originating from the WebLogic Server JVM to unfamiliar external hosts.
Inbound TCP connections to WebLogic ports 7001 or 7002 from untrusted networks, especially with T3 or IIOP protocol headers.
Unexpected child processes spawned by the WebLogic Java process, such as cmd.exe, powershell.exe, /bin/sh, or bash.
New or modified .jsp files in WebLogic application or tmp directories, indicating webshell deployment after exploitation.

Detection Strategies

Inspect WebLogic access logs and network captures for T3 protocol handshakes (t3 12.2.1) and IIOP GIOP magic bytes from external sources.
Monitor JVM process telemetry for JNDI lookups followed by class loading from remote URLs.
Correlate authentication-free inbound sessions on 7001/7002 with subsequent egress to LDAP services on ports 389, 636, or 1389.

Monitoring Recommendations

Enable verbose logging on WebLogic T3 and IIOP listeners and forward logs to a centralized analytics platform.
Alert on any process execution where the parent is java and the command line includes shell interpreters or download utilities.
Track changes to the CISA Known Exploited Vulnerabilities catalog entry for CVE-2023-21839 for updated guidance.

How to Mitigate CVE-2023-21839

Immediate Actions Required

Apply the Oracle Critical Patch Update for January 2023 to all WebLogic Server instances running 12.2.1.3.0, 12.2.1.4.0, or 14.1.1.0.0.
Restrict network access to the T3 and IIOP listeners on ports 7001 and 7002 to trusted management networks only.
Audit WebLogic hosts for indicators of prior compromise, including webshells and unexpected outbound LDAP/RMI traffic.
Rotate credentials, keys, and tokens accessible to compromised WebLogic instances if exploitation is suspected.

Patch Information

Oracle addressed CVE-2023-21839 in the Oracle Critical Patch Update Advisory - January 2023. Administrators must apply the relevant patch for each affected WebLogic version. Federal civilian agencies are required by CISA Binding Operational Directive 22-01 to remediate this vulnerability based on its KEV listing.

Workarounds

Disable the T3 and IIOP protocols if they are not required by configuring connection filters in the WebLogic Administration Console under Security > Filter.
Implement a WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) that denies T3 and IIOP traffic from untrusted source addresses.
Place WebLogic Server behind a reverse proxy that exposes only HTTP/HTTPS application endpoints and blocks direct access to management protocols.

bash

# Example WebLogic connection filter rule blocking T3/IIOP from all external hosts
# Configured via: Domain > Security > Filter > Connection Filter Rules
0.0.0.0/0 * * deny t3 t3s iiop iiops
10.0.0.0/8 * * allow t3 t3s iiop iiops