{
  "Name": "WebLogic deserialize asyncresponseservice(CVE-2019-2725)",
  "Description": "A vulnerability has been discovered in Oracle WebLogic that could allow for remote code execution. This vulnerability exists within the WLS9_ASYNC and WLS-WSAT components of WebLogic, which can allow for deserialization of malicious code. An unauthenticated attacker can exploit this issue by sending crafted requests to the affected application. Successful exploitation of this vulnerability could allow for remote code execution with elevated privileges.",
  "Product": "WebLogic",
  "Homepage": "http://www.oracle.com/technetwork/middleware/weblogic/overview/index.html",
  "DisclosureDate": "2019-04-26",
  "Author": "LubyRuffy",
  "FofaQuery": "app=\"BEA-WebLogic-Server\"",
  "GobyQuery": "",
  "Level": "3",
  "Impact": "Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. ",
  "Recommendation": "- As a temporary workaround, consider disabling the WLS9_ASYNC and WLS-WSAT components until a patch is available.\u003c/br\u003e- When available, apply appropriate updates provided by Oracle to affected systems immediately after appropriate testing.\u003c/br\u003e- Apply the Principle of Least Privilege to all systems and services.\u003c/br\u003e- Verify no unauthorized system modifications have occurred on system before applying patch.\u003c/br\u003e- Monitor intrusion detection systems for any signs of anomalous activity.\u003c/br\u003e- Unless required, limit external network access to affected products.",
  "References": [
    "http://www.cnvd.org.cn/webinfo/show/4999",
    "https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html",
    "https://nvd.nist.gov/vuln/detail/CVE-2019-2725",
    "http://packetstormsecurity.com/files/152756/Oracle-Weblogic-Server-Deserialization-Remote-Code-Execution.html",
    "http://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html",
    "http://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html",
    "http://www.securityfocus.com/bid/108074",
    "https://support.f5.com/csp/article/K90059138",
    "https://www.exploit-db.com/exploits/46780/",
    "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2725"
  ],
  "HasExp": false,
  "ExpParams": [],
  "ExpTips": {
    "Type": "Tips",
    "Content": ""
  },
  "ScanSteps": [
    "AND",
    {
      "Request": {
        "header": {
          "SOAPAction": ""
        },
        "method": "POST",
        "uri": "/_async/AsyncResponseService"
      },
      "ResponseTest": {
        "checks": [
          {
            "bz": "",
            "operation": "==",
            "type": "item",
            "value": "500",
            "variable": "$code"
          },
          {
            "bz": "",
            "operation": "contains",
            "type": "item",
            "value": "\u003cfaultcode\u003eenv:Client\u003c/faultcode\u003e",
            "variable": "$body"
          }
        ],
        "operation": "OR",
        "type": "group"
      },
      "SetVariable": []
    }
  ],
  "Tags": [
    "rce"
  ],
  "CVEIDs": [
    "CVE-2019-2725"
  ],
  "CVSSScore": "9.8"
}