# MA-720.042019: MyCERT Alert - Oracle WebLogic RCE Vulnerability [CVE-2019-2725]

**Date:** 29 Apr 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-720.042019  
**Advisory ID:** MA-720.042019

---

**1.0 Introduction**
> MyCERT received information from valid resources about Remote Code Execution (RCE) that was found in Oracle WebLogic server application which has been assigned CVE number; [CVE-2019-2725] will affect all versions of the software after enabling "wls9\_async\_response.war" and "wls-wsat.war" components. Oracle WebLogic is a Java-based platform to deploy multi-tier distributed  enterprise application swiftly in the cloud. Oracle has released out-of-hand patch for this WebLogic vulnerability in Oracle Fusion Middleware.
**2.0 Impacts**
> The vulnerability works by injecting specially crafted HTTP request without requiring any authorization may allow attackers to remotely execute arbitrary commands on the affected servers. Users are advised to patch any running outdated Oracle WebLogic server as the vulnerability is still under active exploitation.
**3.0 Affected Product**
- Oracle WebLogic 10.x
- Oracle WebLogic 12.1.3
**4.0 Recommendations**
- Remove "wls9\_async\_response.war" and "wls-wsat.war".
- Disable access to /\_async/\* and /wls-wsat/\* URL paths via access policy control.
- After the changes have been made, users are required to restart the WebLogic services.
In this year, MyCERT had released several Alerts and Advisories on current threats and vulnerabilities. System Administrators and Internet Users must be aware of these threats and vulnerabilities by applying necessary patches and updates.
The Alerts and Advisories are available at:
<https://www.mycert.org.my/portal/advisories?id=431fab9c-d24c-4a27-ba93-e92edafdefa5&year=2019&ctype=&keyword=>
For incident reporting and other enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](cyber999@cybersecurity.my) or [[email protected]](mycert@mycert.org.my)
Phone: 1-300-88-2999(monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS:CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: <IOS Users> or <Andriod Users>
**5.0 References**
- <https://thehackernews.com/2019/04/oracle-weblogic-hacking.html?m=1>
- <https://www.oracle.com/technetwork/security-advisory/alert-cve-2019-2725-5466295.html>
- <https://www.helpnetsecurity.com/2019/04/25/oracle-weblogic-zero-day-rce/>
- <https://www.zdnet.com/article/new-oracle-weblogic-zero-day-discovered-in-the-wild/>