CVE-2024-21216: Oracle WebLogic Server RCE Vulnerability

CVE-2024-21216 Overview

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).

Critical Impact

This vulnerability allows for remote code execution by unauthenticated actors, resulting in full server compromise.

Affected Products

• Oracle WebLogic Server 12.2.1.4.0
• Oracle WebLogic Server 14.1.1.0.0

Discovery Timeline

• 2024-10-15 - CVE CVE-2024-21216 published to NVD
• 2024-10-18 - Last updated in NVD database

Technical Details for CVE-2024-21216

Vulnerability Analysis

CVE-2024-21216 is categorized as a critical remote code execution vulnerability affecting the Oracle WebLogic Server. The vulnerability exists within the Core component and can be exploited remotely over T3 and IIOP protocols without requiring authentication. This facilitates the potential for attackers to fully compromise the server.

Root Cause

The vulnerability stems from inadequate input validation on server-bound network protocols, specifically within the T3 and IIOP implementations.

Attack Vector

The attack can be carried out remotely by sending specially crafted data through T3 or IIOP protocols, potentially leading to arbitrary code execution.

// Example pseudo-exploit code (do not use in production)
import weblogic.rmi.*;

public class Exploit {
    public static void main(String[] args) {
        try {
            String target = args[0];
            // Misuse the T3 protocol to send exploit payload
            sendPayload(target, "maliciousPayload");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    private static void sendPayload(String target, String payload) {
        // Placeholder for network send logic
    }
}

Detection Methods for CVE-2024-21216

Indicators of Compromise

• Unexpected network traffic over T3 or IIOP ports
• Log entries indicating unauthorized commands
• Sudden changes in server behavior

Detection Strategies

Implement network traffic analysis to monitor for anomalous T3/IIOP communications. Employ server-side application logs for irregular activity, specifically changes initiated without corresponding known user actions.

Monitoring Recommendations

Regularly audit access logs for unusual timestamps or access patterns. Use SentinelOne's endpoint detection capabilities to flag anomalies consistent with RCE attacks.

How to Mitigate CVE-2024-21216

Immediate Actions Required

• Block T3/IIOP traffic from untrusted networks
• Restrict network access to known IP addresses
• Enable enhanced logging on WebLogic servers

Patch Information

Oracle has released patches for this vulnerability as part of their Critical Patch Update in October 2024. It is recommended to apply these patches immediately.

Workarounds

If patching is not immediately possible, consider disabling the T3 and IIOP protocols to mitigate the attack vector.

# Disable T3 and IIOP protocols
$MW_HOME/oracle_common/common/bin/wlst.sh <<EOF
connect('username', 'password', 't3://localhost:7001')
edit()
startEdit()
cmo.setIIOPEnabled(false)
cmo.setT3Enabled(false)
save()
activate()
exit()
EOF