CVE-2024-21260: Oracle WebLogic Server DoS Vulnerability

CVE-2024-21260 Overview

CVE-2024-21260 is a denial-of-service vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) protocols can exploit the issue to cause a hang or repeatable crash of the server. The vulnerability impacts availability only, with no impact to confidentiality or integrity. Oracle disclosed the vulnerability and released fixes in the October 2024 Critical Patch Update.

Critical Impact
Remote unauthenticated attackers can trigger a complete denial of service of Oracle WebLogic Server through T3 or IIOP protocol requests, taking down business-critical Java EE workloads.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle Fusion Middleware deployments embedding affected WebLogic Server versions

Discovery Timeline

2024-10-15 - CVE-2024-21260 published to the National Vulnerability Database
2024-10-15 - Oracle releases the October 2024 Critical Patch Update with the fix
2024-10-18 - Last updated in the NVD database

Technical Details for CVE-2024-21260

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server. It is reachable through WebLogic's proprietary T3 protocol and through IIOP, both of which support remote method invocation over the network. The advisory categorizes the flaw under [CWE-863] (Incorrect Authorization), indicating that the affected code path can be reached without proper authorization checks. Successful exploitation drives the server into a hang state or repeatable crash, producing a complete denial of service. The issue does not expose data or permit code execution, but it disrupts availability of any application hosted on the affected instance. The current EPSS score is approximately 0.68%, placing it in the 47th percentile for exploitation likelihood.

Root Cause

The root cause is improper authorization within request handling in the Core component, allowing unauthenticated remote callers to invoke logic that destabilizes the server process. Because T3 and IIOP listeners accept connections before application-layer authorization is enforced for this code path, malformed or specifically crafted requests reach a state in which the server cannot recover gracefully.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker reaches the WebLogic listen port that serves T3 or IIOP traffic and submits requests that trigger the vulnerable handler. In typical deployments, T3 runs over the WebLogic administrative listen port, and IIOP shares listener configuration with HTTP. Internet-exposed WebLogic instances with T3 or IIOP enabled are directly reachable. Internal exposure is also relevant because WebLogic is frequently deployed behind reverse proxies that do not filter T3 or IIOP.

No verified public proof-of-concept code is available. Technical details should be referenced from the Oracle Critical Patch Update - October 2024.

Detection Methods for CVE-2024-21260

Indicators of Compromise

Sudden WebLogic managed server hangs or JVM crashes without prior load increase, especially correlated with inbound T3 or IIOP connections.
Unexpected connections to WebLogic listen ports (default 7001, 7002) from untrusted source IPs.
Repeated short-lived T3 or IIOP sessions originating from a single external host preceding a server outage.

Detection Strategies

Inspect WebLogic AdminServer.log and managed server logs for stack traces tied to T3 or IIOP request dispatch immediately before service termination.
Enable WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) logging to capture protocol-level access attempts on T3 and IIOP.
Correlate network flow records with WebLogic process restart events to identify pre-crash traffic patterns.

Monitoring Recommendations

Monitor JVM availability and listener health on all WebLogic instances and alert on unplanned restarts.
Track inbound traffic to T3 and IIOP ports and baseline expected client IPs; alert on deviations.
Forward WebLogic and host telemetry to a centralized analytics platform and retain it long enough to investigate slow-burn DoS patterns.

How to Mitigate CVE-2024-21260

Immediate Actions Required

Apply the October 2024 Oracle Critical Patch Update to all WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 deployments.
Inventory all WebLogic instances, including those embedded inside Oracle Fusion Middleware products, and confirm patch coverage.
Restrict network reachability of T3 and IIOP listen ports to trusted management subnets only.

Patch Information

Oracle issued the fix in the October 2024 Critical Patch Update. Administrators should download and apply the patches listed in the Oracle Critical Patch Update Advisory - October 2024 for each affected WebLogic Server version. Restart of affected managed servers is required for the patch to take effect.

Workarounds

Configure WebLogic Connection Filters to deny T3 and T3s connections from untrusted sources until patching is complete.
Disable IIOP at the server level if no clients require it, using the WebLogic Server Administration Console under Protocols configuration.
Place WebLogic instances behind a firewall or load balancer that does not forward T3 or IIOP traffic from the public internet.

bash

# Example WebLogic Connection Filter rules to block T3/T3s and IIOP from untrusted networks
# Set in: Domain > Security > Filter > Connection Filter Rules
# Format: target localAddress localPort action protocols

10.0.0.0/8     * * allow t3 t3s iiop iiops
0.0.0.0/0      * * deny  t3 t3s iiop iiops