Metasploit Module: Oracle Weblogic PreAuth Remote Command Execution via ForeignOpaqueReference IIOP Deserialization
Type: exploit
Path: modules/exploits/multi/iiop/cve_2023_21839_weblogic_rce.rb
Platform: %w[unix linux
Disclosure date: 2023-01-17
References: CVE-2023-21839, URL-https://www.oracle.com/security-alerts/cpujan2023.html, URL-https://github.com/gobysec/Weblogic/blob/main/WebLogic_CVE-2023-21931_en_US.md, URL-https://github.com/gobysec/Weblogic/blob/main/Weblogic_Serialization_Vulnerability_and_IIOP_Protocol_en_US.md, URL-http://web.archive.org/web/[PII_REDACTED]2940/https://github.com/4ra1n/CVE-2023-21839, URL-https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability
Targets: Linux

Description:
Oracle Weblogic 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 prior to the Jan 2023 security update are vulnerable to an unauthenticated
          remote code execution vulnerability due to a post deserialization vulnerability. This occurs when an attacker serializes
          a "ForeignOpaqueReference" class object, deserializes it on the target, and then post deserialization, calls the
          object's "getReferent()" method, which will make use of the "ForeignOpaqueReference" class's "remoteJNDIName" variable,
          which is under the attackers control, to do a remote loading of the JNDI address specified by "remoteJNDIName" via
          the "lookup()" function.

          This can in turn lead to a deserialization vulnerability whereby an attacker supplies the address of a HTTP server hosting
          a malicious Java class file, which will then be loaded into the Oracle Weblogic process's memory and an attempt to
          create a new instance of the attacker's class will be made. Attackers can utilize this to execute arbitrary Java
          code during the instantiation of the object, thereby getting remote code execution as the "oracle" user.

          This module exploits this vulnerability to trigger the JNDI connection to a LDAP server we control. The LDAP server will
          then respond with a remote reference response that points to a HTTP server that we control, where the malicious Java
          class file will be hosted. Oracle Weblogic will then make a HTTP request to retrieve the malicious Java class file,
          at which point our HTTP server will serve up the malicious class file and Oracle Weblogic will instantiate
          an instance of that class, granting us RCE as the "oracle" user.

          This vulnerability was exploited in the wild as noted by KEV on May 1st 2023: https://www.fortiguard.com/outbreak-alert/oracle-weblogic-server-vulnerability

Check method (fingerprinting):
begin
      @version = get_weblogic_version
      fail_with(Failure::UnexpectedReply, 'Could not find the target Weblogic version in the t3 response!') if @version.nil?
    rescue ::Timeout::Error
      fail_with(Failure::TimeoutExpired, 'Was unable to connect to target. Connection timed out.')
    rescue Rex::AddressInUse
      fail_with(Failure::BadConfig, 'Address is currently in use')
    rescue Rex::HostUnreachable
      fail_with(Failure::Unreachable, 'Target host is unreachable!')
    rescue Rex::ConnectionRefused
      fail_with(Failure::Disconnected, 'Target refused connection!')
    rescue ::Errno::ETIMEDOUT, Rex::ConnectionTimeout
      fail_with(Failure::TimeoutExpired, 'Was unable to connect to target. Connection timed out.')
    end

    if @version.between?(Rex::Version.new('12.2.1.3.0'), Rex::Version.new('12.2.1.3.9999'))
      return CheckCode::Vulnerable('Target is a Oracle WebServer 12.2.1.3 server, and is vulnerable!')
    elsif @version.between?(Rex::Version.new('12.2.1.4.0'), Rex::Version.new('12.2.1.4.9999'))
      return CheckCode::Vulnerable('Target is a Oracle WebServer 12.2.1.4 server, and is vulnerable!')
    elsif @version.between?(Rex::Version.new('14.1.1.0.0'), Rex::Version.new('14.1.1.0.9999'))
      return CheckCode::Vulnerable('Target is a Oracle WebServer 14.1.1.0 server, and is vulnerable!')
    else
      return CheckCode::Safe('Target is not a vulnerable version of Oracle WebServer!')
    end
  end

  # HTTP Server Related Functions and O