CVE-2024-21234: Oracle WebLogic Server Auth Bypass Flaw

CVE-2024-21234 Overview

CVE-2024-21234 is a high-severity vulnerability in Oracle WebLogic Server, a component of Oracle Fusion Middleware. The flaw resides in the Core component and affects supported versions 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) can exploit this vulnerability without user interaction. Successful exploitation can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. Oracle published the vulnerability as part of the October 2024 Critical Patch Update.

Critical Impact

Unauthenticated remote attackers can compromise the confidentiality of all data accessible to Oracle WebLogic Server through exposed T3 or IIOP protocols.

Affected Products

• Oracle WebLogic Server 12.2.1.4.0
• Oracle WebLogic Server 14.1.1.0.0
• Oracle Fusion Middleware deployments using affected WebLogic Server versions

Discovery Timeline

• 2024-10-15 - Oracle published the vulnerability in the October 2024 Critical Patch Update
• 2024-10-15 - CVE-2024-21234 published to the National Vulnerability Database (NVD)
• 2024-10-18 - Last updated in the NVD database

Technical Details for CVE-2024-21234

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server. It is classified under [CWE-862] Missing Authorization, indicating that the server fails to enforce authorization checks on requests received over the T3 and IIOP protocols. Attackers can leverage this gap to retrieve data that should only be accessible to authenticated principals.

The vulnerability impacts confidentiality only. Integrity and availability are not affected, according to the CVSS metrics published by Oracle. However, the data exposure scope includes all data the WebLogic Server can access, which often spans application secrets, session data, and backend connection details.

Exploitation is network-reachable and does not require credentials or user interaction. WebLogic deployments that expose T3 or IIOP listeners to untrusted networks are at the highest risk.

Root Cause

The root cause is a missing authorization check on remote protocol handlers in the WebLogic Core component. Requests delivered through T3 and IIOP do not undergo the access control validation required before returning sensitive server data. This authorization gap aligns with the CWE-862 classification assigned to the issue.

Attack Vector

The attack vector is the network. An attacker sends crafted requests to a WebLogic Server listener that accepts T3 or IIOP traffic. Both protocols are commonly enabled by default on WebLogic admin and managed server ports. Because authentication is not required, any network endpoint capable of reaching the listener can attempt exploitation. Oracle has not published exploitation details, and no public proof-of-concept code has been observed at the time of writing. Refer to the Oracle Security Alert - October 2024 for vendor guidance.

Detection Methods for CVE-2024-21234

Indicators of Compromise

• Unexpected inbound connections to WebLogic T3 listener ports (default 7001) or IIOP ports from untrusted source addresses.
• WebLogic access logs showing repeated unauthenticated protocol handshakes followed by data retrieval operations.
• Outbound transfers of sensitive configuration or session data from WebLogic hosts to external destinations.

Detection Strategies

• Monitor WebLogic server logs for anomalous T3 and IIOP protocol activity, particularly from non-application client subnets.
• Inspect network traffic for T3 protocol handshakes (t3:// signatures) originating from the public internet or untrusted zones.
• Correlate Java Naming and Directory Interface (JNDI) lookups and JMX operations executed without prior authentication events.

Monitoring Recommendations

• Enable verbose protocol logging on WebLogic listeners to capture client identity, source IP, and method invocations.
• Forward WebLogic and host telemetry to a centralized analytics platform for behavioral baselining.
• Alert on connections to T3 or IIOP ports from any source outside the documented application tier.

How to Mitigate CVE-2024-21234

Immediate Actions Required

• Apply the October 2024 Oracle Critical Patch Update to all Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 deployments.
• Restrict network exposure of WebLogic T3 and IIOP listeners to trusted application subnets only.
• Audit existing WebLogic deployments to identify instances reachable from untrusted networks.

Patch Information

Oracle released fixes for CVE-2024-21234 as part of the October 2024 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert - October 2024. Patches must be applied to both 12.2.1.4.0 and 14.1.1.0.0 versions where deployed.

Workarounds

• Disable the T3 and IIOP protocols on WebLogic listeners where they are not required for application functionality.
• Use WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow T3 and IIOP only from explicit IP ranges.
• Place WebLogic Server behind a reverse proxy or firewall that blocks direct T3 and IIOP access from external networks.

# Example WebLogic connection filter configuration
# Place in the WebLogic Server console: Domain > Security > Filter
# Format: target localAddress localPort action protocols

# Allow T3/IIOP only from the trusted application subnet
10.10.20.0/24 * 7001 allow t3 t3s iiop iiops

# Deny all other T3/IIOP traffic
0.0.0.0/0 * 7001 deny t3 t3s iiop iiops