Detection of attempts to exploit CVE-2020-14882 and CVE-2020-14750 - Unauthenticated RCE in Oracle's Weblogic Server.
Oracle's advisories:
- CVE-2020-14882 https://www.oracle.com/security-alerts/cpuoct2020traditional.html
- CVE-2020-14750 https://www.oracle.com/security-alerts/alert-cve-2020-14750.html
Exploit PoC (in Vietnamese):
- https://testbnull.medium.com/weblogic-rce-by-only-one-get-request-cve-2020-14882-analysis-6e4b09981dbf
Exploit PoC video: - https://youtu.be/JFVDOIL0YtA
Vendor write-ups including exploitation in the wild:
- https://isc.sans.edu/forums/diary/PATCH+NOW+CVE202014882+Weblogic+Actively+Exploited+Against+Honeypots/26734/
- https://isc.sans.edu/forums/diary/Cryptojacking+Targeting+WebLogic+TCP7001/26768/
- https://blog.rapid7.com/2020/10/29/oracle-weblogic-unauthenticated-complete-takeover-cve-2020-14882-what-you-need-to-know/
- https://threatpost.com/oracle-update-weblogic-server-flaw/160889/
| Detection scope | notice msg | notice sub field | Fidelity of alert |
|---|---|---|---|
| POST method successful exploit | Potentially successful exploit of Oracle's WebLogic Server Remote Code Execution vulnerability (CVE-2020-14882 and CVE-2020-14750) using POST method. Refer to https://www.oracle.com/security-alerts/cpuoct2020traditional.html and https://www.oracle.com/security-alerts/alert-cve-2020-14750.html. See sub field for artifacts. | [REDACTED due to TLP of source pcap] | HIGH |
| GET method successful exploit | Potentially successful exploit of Oracle's WebLogic Server Remote Code Execution vulnerability (CVE-2020-14882 and CVE-2020-14750) using GET method. Refer to https://www.oracle.com/security-alerts/cpuoct2020traditional.html and https://www.oracle.com/security-alerts/alert-cve-2020-14750.html. See sub field for artifacts. | [REDACTED due to TLP of source pcap] | HIGH |
| POST method unsuccessful attempt | Unsuccessful exploit attempt of Oracle's WebLogic Server Remote Code Execution vulnerability (CVE-2020-14882 and CVE-2020-14750) using POST method. Refer to https://www.oracle.com/security-alerts/cpuoct2020traditional.html and https://www.oracle.com/security-alerts/alert-cve-2020-14750.html. See sub field for artifacts. | [REDACTED due to TLP of source pcap] | HIGH |
| GET method unsuccessful attempt | Unsuccessful exploit attempt of Oracle's WebLogic Server Remote Code Execution vulnerability (CVE-2020-14882 and CVE-2020-14750) using GET method. Refer to https://www.oracle.com/security-alerts/cpuoct2020traditional.html and https://www.oracle.com/security-alerts/alert-cve-2020-14750.html. See sub field for artifacts. | [REDACTED due to TLP of source pcap] | HIGH |
-
This package can include a sample of the Server's response in the notice. This is to assist incident responders triage the detection. If you wish to have the server response artifacts included in your notice.log, change this option in scripts/main.zeek from the default
FtoTlike so:
const include_exploited_server_response_in_notice: bool = T; -
By default this package detects on all TCP ports, not just the default port 7001/tcp. To change the behavior to only detect on the specified port, use these options in scripts/main.zeek:
const detect_default_port_only: bool = T;
const default_port: port = 7001/tcp; -
By default this package detects ALL exploit attempts - successful and unsuccessful. To change the behavior to only detect successful exploits, use these options in scripts/main.zeek:
const detect_unsuccessful_attempts: bool = F; -
If you have scanners that you wish to exclude from detection, add them to the scripts/scanner_exclude_from_detection.zeek file.
-
To run against a pcap you already have
zeek -Cr your.pcap scripts/__load__.zeek -
This package will run in clustered or non clustered environments.
- As details emerge, we are keen to improve this package for the benefit of the community, please feel free to contact the author with any suggestions and feedback.