CVE-2024-21274 Overview
CVE-2024-21274 is a denial of service vulnerability in the Console component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.1.0.0. An unauthenticated attacker with network access via HTTP can exploit the vulnerability to cause a hang or repeatable crash, resulting in complete denial of service of the WebLogic Server instance. Oracle disclosed the issue in the Oracle Critical Patch Update Advisory - October 2024. The vulnerability is classified under [CWE-120] (Buffer Copy without Checking Size of Input) and carries an EPSS score of 0.264%.
Critical Impact
Remote, unauthenticated attackers can trigger a complete denial of service on Oracle WebLogic Server instances exposing the administration Console over HTTP.
Affected Products
- Oracle WebLogic Server 12.2.1.4.0
- Oracle WebLogic Server 14.1.1.0.0
- Oracle Fusion Middleware deployments using the WebLogic Console component
Discovery Timeline
- 2024-10-15 - CVE-2024-21274 published to NVD
- 2024-10-15 - Oracle releases security patch in October 2024 Critical Patch Update
- 2024-10-18 - Last updated in NVD database
Technical Details for CVE-2024-21274
Vulnerability Analysis
The vulnerability resides in the Console component of Oracle WebLogic Server. The Console is the web-based administrative interface that ships enabled by default in many WebLogic deployments. An attacker sends a specially crafted HTTP request to the Console endpoint to trigger the flaw. Successful exploitation causes the server process to hang or crash, removing it from service until restart. The vulnerability does not require authentication, user interaction, or elevated privileges, which lowers the bar for exploitation against any reachable instance.
The issue impacts availability only. Confidentiality and integrity of data on the server are not affected by this specific flaw. Because WebLogic Server frequently hosts business-critical Java EE applications, repeated exploitation can produce sustained outages of dependent services and middleware integrations.
Root Cause
The vulnerability is associated with [CWE-120], a buffer copy operation that does not validate the size of the input. Improper bounds handling in the Console request processing path allows malformed input to disrupt server state. Oracle has not published low-level technical details, in keeping with its Critical Patch Update disclosure practice.
Attack Vector
The attack vector is the network. An attacker with HTTP access to the WebLogic administration Console submits crafted requests that trigger the denial of service condition. No credentials are required. Public-facing WebLogic Console endpoints and instances reachable from compromised internal hosts are at the highest risk.
No public exploit, proof of concept, or CISA Known Exploited Vulnerabilities listing exists for this CVE at the time of writing. See the Oracle Security Alert October 2024 for vendor guidance.
Detection Methods for CVE-2024-21274
Indicators of Compromise
- Unexpected WebLogic Server process hangs, restarts, or crashes correlated with inbound HTTP traffic to the Console URI (typically /console).
- Anomalous HTTP requests to administrative Console paths from untrusted source addresses.
- Spikes in 5xx HTTP responses or connection resets from WebLogic managed servers.
Detection Strategies
- Inspect web access logs and reverse proxy logs for unusual request patterns targeting /console/* endpoints, particularly from external networks.
- Correlate WebLogic server log entries showing thread hangs, OutOfMemoryError, or unexpected shutdown events with prior HTTP request activity.
- Use network intrusion detection signatures that flag malformed HTTP requests directed at WebLogic administration ports.
Monitoring Recommendations
- Monitor the availability and uptime of WebLogic managed servers, alerting on repeated restart events within short intervals.
- Track exposure of WebLogic Console ports (default 7001 and 7002) using external attack surface management to identify internet-facing instances.
- Forward WebLogic and application server logs to a centralized analytics platform for correlation with network telemetry.
How to Mitigate CVE-2024-21274
Immediate Actions Required
- Apply the Oracle October 2024 Critical Patch Update to all affected WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 deployments.
- Inventory all WebLogic instances and confirm whether the administration Console is exposed to untrusted networks.
- Restrict network access to the Console through firewall rules, network segmentation, or VPN-only access until patches are applied.
Patch Information
Oracle released fixes for CVE-2024-21274 as part of the October 2024 Critical Patch Update. Customers should consult the Oracle Critical Patch Update Advisory - October 2024 for the specific patch numbers applicable to their deployment and follow Oracle's documented patching procedure for Fusion Middleware components.
Workarounds
- Disable the WebLogic administration Console in production environments where it is not required by setting the Console Enabled flag to false in the domain configuration.
- Place WebLogic Console endpoints behind an authenticated reverse proxy or web application firewall that filters requests to administrative URIs.
- Limit source IP addresses permitted to reach the Console port via host-based or perimeter firewall rules.
# Example: restrict access to WebLogic Console port 7001 to a management subnet
iptables -A INPUT -p tcp --dport 7001 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
