Details on the Oracle WebLogic Vulnerability Being Exploited in the Wild

Any ability to invoke ChainedExtractor.extract() will still result in remote code execution. The report from Quynh Le shows that it is still possible to reach ChainedExtractor.extract() via the ExtractorComparator and AbstractExtractor classes. Let’s start by looking at the compare() method of ExtractorComparator:

As shown above, it is still possible to invoke ChainedExtractor.extract() by setting this.m_extractor to an instance of ChainedExtractor .

Similarly, the compare() method of the AbstractExtractor abstract class could also be used.

The MultiExtractor class extends AbstractExtractor and can be used to reach ChainedExtractor.extract():

The Full Gadget Chain

In order to develop a full gadget chain, we need the ability to call compare() method of an arbitrary Comparator from readObject(). The publicly documented method of doing this is using the PriorityQueue class as shown by the following ysoserial gadgets: BeanShell1, Jython1, CommonsCollections2, CommonsBeanutils1, CommonsCollections4 and Groovy1:

SiftUpUsingComparator() can invoke the compare() method of an arbitrary Comparator:

There are also other methods of accomplishing this. For example, the following method was used by the submitter:

In summary, the toString() method of the Mutations class could result in a call to ConcurrentSkipListMap.size():

From ConcurrentSkipListMap.size(), it is possible to invoke the compare() method of an arbitrary Comparator.

Demonstrating the Gadget Chains

By using the above methods, the following full gadget chain was constructed for the ExtractorComparator case:

The following video demonstrates this gadget chain being used to gain RCE via the T3 protocol.

And for the AbstractExtractor example, the following chain was used:

The following video demonstrates this gadget chain being used to gain RCE via the T3 protocol:

This vulnerability resides in BIRemotingServlet, which listens on port TCP port 7780 and does not require any authentication:

BIRemotingServlet uses AMF (Action Message Format) to communicate with a client.

As shown, when the AMF packet is deserialized, arbitrary objects may be reconstructed in AMF3ObjectInput via a call to readComplexObject().

In this example, a UnicastRef object is reconstructed resulting in a call to the server-side distributed garbage collector for a remote object, allowing us to respond with an arbitrary serialized object. Responding with one of the gadget chains as described above results in an RCE.